Connect over Tailscale

Tailscale is the easiest way to reach a gateway running at home from your laptop or phone, without opening ports to the internet.

Turn on Tailscale Serve on the gateway host. The gateway stays private to your tailnet, and Tailscale adds HTTPS:
Terminal window
```
openclaw config set gateway.tailscale.mode serve
openclaw gateway restart
```
See OpenClaw’s stable HTTPS URL guide for details.
Make sure your device is on the same tailnet. Install Tailscale on your Mac or iPhone and sign in to the same account.
Add the gateway in Pincer. On first launch choose Get Started (or choose Add Gateway… from the gateway button at the top of the sidebar, the macOS Gateway menu, or ⌘ K). On Find your gateway, choose Tailscale and enter the address:
- With Tailscale Serve: wss://<host>.<tailnet>.ts.net, for example wss://my-mac.tail1234.ts.net. Serve uses HTTPS on port 443, so leave off the port. You can type just the host name.
- Directly by tailnet IP: ws://100.x.y.z:18789, if the gateway is bound to its tailnet IP (gateway.bind: "tailnet") instead of using Serve.
Sign in with your gateway’s token (openclaw config get gateway.auth.token) or password.
Approve the device. The first time, Pincer shows the exact command to run on the gateway host:
Terminal window
```
openclaw devices approve <requestId>
```
Pincer moves on by itself after you approve it. If another device is already paired with Full Management, you can approve it there instead, under Gateway Settings → Operator Devices. See Connect a gateway for the full walkthrough and Devices & Nodes.

On the go

Because the device identity and secret stay in the Keychain, Pincer reconnects whenever Tailscale is up, whether you’re on home Wi-Fi or on cellular. Notifications for chats you aren’t looking at arrive as they happen while Pincer is connected. On iOS, to get notifications while Pincer is closed, set up a push relay.