Deploy an agent under Owyhee.

DigitalOcean is a cloud provider that rents small servers by the month. Sign up at digitalocean.com — you'll need an email and a payment method. Nothing is charged until you create a server, and destroying the server stops the billing.

A droplet is just DigitalOcean's name for one rented server. From the DigitalOcean dashboard, click the green Create button (top right) and choose Droplets. Then pick:

• Region — whichever city is closest to you. Any of them works.
• OS image — Ubuntu 24.04 (LTS), usually the default.
• Size — Basic → Regular. The $6/mo option (1 GB RAM) is enough to start; pick the $12/mo one (2 GB) if you want headroom.
• Authentication — choose Password if you don't have SSH keys; pick a strong root password and store it safely. You'll rarely need it — the agent is managed from your Owyhee console, not from the server.

cloud-init is a small setup script the server runs automatically the first time it boots — you never have to type commands on the server yourself. On the same create screen, scroll to Advanced Options and tick Add Initialization scripts (free); a text box appears. Paste this whole block and change one line — put your real email where it says [email protected]. It installs Docker, pulls the public hardened agent image, and boots the agent (loopback-only; no API keys or passwords go in this box).

#cloud-config
# Owyhee-hardened OpenClaw — DigitalOcean user-data.
# Set OWYHEE_DEPLOY_EMAIL to your email (it receives the claim link). No model key here.
write_files:
  - path: /etc/owyhee/agent.env
    permissions: '0600'
    content: |
      [email protected]
      OWYHEE_BASE_URL=https://console.kipplelabs.com
      OWYHEE_MCP_SERVERS=
      OWYHEE_DEPLOY_TOKEN=
      OWYHEE_DEPLOY_REF=digitalocean
runcmd:
  - curl -fsSL https://get.docker.com | sh
  - systemctl enable --now docker
  - docker volume create owyhee-data
  - |
    docker run -d --name owyhee-agent --restart unless-stopped \
      --env-file /etc/owyhee/agent.env \
      -v owyhee-data:/data \
      ghcr.io/machinesofdesire/owyhee-openclaw:latest
  - echo "Owyhee agent started. Check your email for the claim link, then claim the account at https://console.kipplelabs.com" > /root/OWYHEE-README.txt

Click Create Droplet. The first boot takes about 3–5 minutes while the server installs Docker and pulls the agent image. You don't need to watch it — the next thing that happens is an email.

The agent provisions a claimable Owyhee account keyed to the email you set, and sends that address a claim link. Click it and sign in — that's what connects your agent to Owyhee. No key ever touches the server.

In the Owyhee console, add your LLM provider (Claude, GPT, or a local model) and any tools. Credentials go into Owyhee custody — the server never sees them. Grant the agent exactly what it may use; watch, cap, or kill it anytime.

Easiest check: your agent shows as connected in the Owyhee console. To look under the hood, open your droplet in DigitalOcean and click Access → Launch Droplet Console (a terminal in your browser, no setup), then run:

docker ps

You should see owyhee-agent with a status of Up. To see what it's doing:

docker logs owyhee-agent --tail 50

No claim email after ~10 minutes? Check spam, run the logs command above, or write us at [email protected].

Change one thing — your email — then run it. The agent provisions a claimable Owyhee account and prints nothing sensitive.

docker run -d --name owyhee-agent --restart unless-stopped \
  -e [email protected] \
  -p 127.0.0.1:18789:18789 \
  -v owyhee-data:/data \
  ghcr.io/machinesofdesire/owyhee-openclaw:latest

You get a claim link keyed to that email. Click it, sign in, and the agent is yours — its keys were never on the box.

In the Owyhee console, add your tools and LLM provider. Credentials go into custody; grant the agent exactly what it may use, and cap or kill it anytime.

Your agent shows as connected in the Owyhee console. Or check locally:

docker ps

You should see owyhee-agent with a status of Up.