OpenClaw + n8n Integration: Connect an Autonomous Agent to Your Workflows

Why connect them at all?

Most teams reach this question after hitting one of two walls.

The first: you have n8n workflows that work, but every trigger is rigid. A webhook fires, a schedule ticks, a row changes. There is no path for "when a client messages us on WhatsApp asking to reschedule, figure out what they mean and start the right workflow." That gap is where agents belong.

The second: you started with an agent, gave it database and API access, and realised you now have a system that can take irreversible actions with no audit trail and no replay. That is a genuinely bad place to be in production.

The integration answers both. The agent handles ambiguity — parsing intent, holding context across a conversation, deciding which thing to do. The workflow engine handles consequence — the actual writes, the retries, the error branches, the log of what ran and when. If something goes wrong at 2am, you are debugging an n8n execution log, not asking a model to explain itself.

What OpenClaw actually is (and what it is not)

OpenClaw is a self-hosted gateway that sits between your messaging apps and an LLM agent. It is MIT-licensed, copyright the OpenClaw Foundation, so self-hosting and commercial deployment carry no copyleft or source-disclosure obligation — only MIT's attribution condition. It was built by Peter Steinberger and the community, went through two renames in late January 2026 (Clawdbot, then Moltbot, then OpenClaw), and is now stewarded by the OpenClaw Foundation; Steinberger joined OpenAI in February 2026 and is no longer the day-to-day maintainer. It is widely adopted, but published star and fork counts vary by source and date, so we are not printing one here — check the repository if you need a current figure.

Practically, it runs a local gateway on port 18789 and connects to Discord, Google Chat, iMessage, Matrix, Microsoft Teams, Signal, Slack, Telegram, WhatsApp and Zalo. Configuration lives at ~/.openclaw/openclaw.json, with a workspace at ~/.openclaw/workspace. It will talk to Anthropic, OpenAI and DeepSeek models, or to a local model through Ollama.

What it is not: a hosted product, a managed service, or something you should expose to the internet casually. There is no official cloud offering. Anything advertising "OpenClaw hosting" is a third party putting a managed install on a VPS.

The security part, before you build anything

This section is not boilerplate. OpenClaw's own README tells you to treat inbound messages as untrusted input, and the record since launch explains why.

• Token exfiltration via gatewayUrl — tracked as CVE-2026-25253, affecting releases up to and including 2026.1.28. If you are pinned to an older build, this is the one to check first. Take version ranges from the advisory itself; several write-ups circulating online state a different affected range.
• Third-party skills are executable code. A skill can ship scripts and request tools. Installing one from a marketplace is closer to curl | bash than to installing a browser extension — read it before you enable it.
• Gateways get exposed by accident. Security researchers have repeatedly found instances reachable from the public internet. Published counts differ by an order of magnitude depending on scanning methodology, so we will not quote a number — the actionable point is simply that this is the common failure, and it is yours to avoid.
• The threat model now has a standard. OWASP published a Top 10 for Agentic Applications (v2.01, June 2026). If you are deploying an agent with tool access, that list is a better checklist than anything in this article.

None of that makes OpenClaw unusable. It does mean the integration below assumes three things: the gateway is not reachable from the public internet, the agent runs as an unprivileged user, and every skill you install is one you have read. If you cannot commit to those, connect it to a staging n8n instance and nothing else until you can.

Direction one: OpenClaw triggers an n8n workflow

This is the direction that carries most of the value, and it is the simpler of the two. You are giving the agent a narrow, auditable button to press rather than broad credentials.

Step 1 — Build the n8n side first

Add a Webhook node in n8n, set the method to POST, and give it a path you would not guess. Under authentication choose Header Auth and create a credential — a header name such as x-api-key and a long random value. Do not skip this. An unauthenticated n8n webhook is a public API for writing to your systems.

Build the rest of the workflow normally and, importantly, end it with a Respond to Webhook node returning something the agent can read back to the user — a booking reference, a status, an error string.

Step 2 — Write the OpenClaw skill

OpenClaw skills are folders containing a SKILL.md file with YAML frontmatter, loaded from ~/.openclaw/skills/ or the workspace skills/ directory. The frontmatter takes name, a description under 160 characters, and optionally allowed-tools, user-invocable and license. A skill can also carry scripts/, references/ and assets/ subfolders.

The description field is doing more work than it looks. It is how the agent decides whether this skill is relevant to what the user just said, so write it for that job, not as documentation.

---
name: create-booking
description: Create or reschedule a customer booking. Use when someone asks to book, move or cancel an appointment.
allowed-tools: [bash]
user-invocable: true
license: MIT
---

# Create booking

Call the booking workflow with the customer's name, phone and requested slot.
Report the returned reference number back to the user verbatim.
Never invent a reference number. If the call fails, say so plainly.

## How to call it

Run:

    scripts/book.sh "<name>" "<phone>" "<iso8601-datetime>"

And the script it points at:

#!/usr/bin/env bash
set -euo pipefail

curl -sS --max-time 20 \
  -X POST "https://n8n.internal.example.com/webhook/6f2a1c-booking" \
  -H "Content-Type: application/json" \
  -H "x-api-key: ${N8N_WEBHOOK_KEY:?missing N8N_WEBHOOK_KEY}" \
  -d "$(printf '{"name":%s,"phone":%s,"slot":%s}' \
        "$(printf '%s' "$1" | jq -Rs .)" \
        "$(printf '%s' "$2" | jq -Rs .)" \
        "$(printf '%s' "$3" | jq -Rs .)")"

Two details worth copying. The key comes from the environment, not the file, so it never lands in a git repo or a skill you might share. And every argument goes through jq -Rs rather than string interpolation — the values here originate in a chat message from someone you do not control, and that is exactly the input class the README warns about.

Step 3 — Give the workflow the final say

Validate inside n8n, not in the skill. Check the slot is actually free, the phone number is real, the customer exists. The agent proposes; the workflow decides. If validation fails, return a clear message and let the agent relay it.

Direction two: n8n calls OpenClaw

The reverse is useful when a deterministic trigger needs a judgement call — an inbound email that needs classifying, a support ticket that needs summarising before routing.

Use an HTTP Request node pointed at the gateway on port 18789. Two constraints matter here. First, that port should be bound to localhost or a private interface only, which in practice means running n8n and OpenClaw on the same host or across a private network — this is the single most common way people accidentally expose a gateway. Second, put a hard timeout on the node and design the branch that runs when the model is slow or unavailable, because it will be.

Do not put an agent in the path of anything that must complete. Use it to enrich, classify or draft; keep the critical path deterministic.

Where each one belongs

What this costs to run

The server is the cheap part. A small VPS with 2 vCPU and 8 GB of RAM handles a gateway plus a self-hosted n8n comfortably for a single business, and that is a modest monthly bill in most regions.

The model usage is the part that surprises people. Every message the agent reasons about is billed per token, and an agent that plans, acts and re-checks makes several model calls where a chatbot makes one. Conversation volume, not server size, is what moves your bill. Before you roll this out to a live channel, run a week on a low-traffic one and read the actual usage. We will publish measured numbers from our own setup rather than estimates.

Common questions

Can I run both on one VPS?

Yes, and for most small deployments you should. It keeps the gateway off the public network and removes a network hop from every call. Give it 8 GB of RAM if the agent will do any browser automation — 4 GB is not enough for that.

Do I need a paid n8n licence?

Self-hosted n8n is source-available under a fair-code licence and free to run for internal business use. Reselling it as a hosted product is the case that needs a commercial agreement. Check the current terms yourself before building a client offering on it.

Is this safe enough for customer data?

Only if you treat it like any other system handling personal data — private networking, least privilege, logging, and a clear view of what leaves your server. Note that sending customer details to a hosted model is a cross-border transfer question if you operate in India under the DPDP framework. That deserves its own article, and it is on our list.

What if the agent does something wrong?

This is why the workflow holds the credentials and the agent does not. The blast radius of a bad decision should be "called a webhook that refused it", not "wrote to production". Design for that from the first day, not after the first incident.

Should I use NVIDIA NemoClaw instead?

Not yet, and be careful with what you read about it. NVIDIA announced NemoClaw and the OpenShell runtime at GTC in March 2026, and the public repository describes itself as alpha. NVIDIA's announcement did not carry a GA date, a price, or licence terms for the platform. The exact relationship between NemoClaw and OpenClaw is described inconsistently across secondary coverage and is not something we can state from primary sources — so treat it as a project to evaluate, not a deployment target, and read NVIDIA's own material rather than the explainers.

If you would rather not build it yourself

We build and self-host this kind of setup for clients — n8n workflows, the agent layer on top, and the private networking that keeps the gateway off the internet. If you are running Zapier or Make today and the bill has stopped making sense, that migration is what our n8n work covers, and the platform trade-offs are laid out in our n8n vs Zapier vs Make comparison.

Facts about OpenClaw releases, ports and skill format verified against the official documentation and repository on 6 August 2026. Version numbers, star counts and pricing in this space change weekly — check the primary sources before relying on any figure here.