Minimum Production Setup

Minimum Production setup

Use this path for the dexgate Production ($99) early-access / pilot plan. Multi-environment deployments are optional and documented separately. This is not a general-availability production guarantee.

Status and coverage details are in the compatibility matrix and on Adapters.

The paid pilot runtime is shared. Point any entitled adapter (OpenClaw recommended free path, Codex available free, or a roadmap adapter when published) at the same Dexgate policy runtime once you have secrets from the console.

How do you want to set up?

Same outcomes—pick the path that fits your workflow. Free adapters need no account; paid pilot needs entitled runtime access.

Recommended for first install

Guided docs

Follow quickstarts and the minimum paid topology in the browser—step-by-step human runbooks.

OpenClaw free Codex free Paid minimum

Use your coding agent

Setup prompts

Copy prompts into OpenClaw, Codex, Claude Code, Cursor, or similar. Prompts require real command output and linked docs. Use only credentials issued through the Dexgate workspace.

Open setup prompts

Human-guided

Talk to us

Enterprise rollout help, guided pilot, or product questions.

Founding pilot Contact

What you need

Piece	Where it runs	Notes
Free adapter	Your agent machine (Windows, macOS, or Linux)	npm package only — no Passport
Dexgate policy runtime	One Linux Docker host	Required for paid decisions and Action Passport evidence
Agent host	Same host as the Docker runtime for initial evaluation, or a separate Windows/macOS agent	Points adapter at `pdpUrl`

Windows note: Free install and agent hooks work on Windows. The paid runtime bootstrap targets Linux Docker (or WSL2 with Docker Desktop). Plan for one Linux host before checkout if you only have Windows today.

Detailed operator topology, administrative interfaces, and credential rotation procedures are provided through the customer console after purchase.

Implementation steps

Complete free first success for your adapter (OpenClaw or Codex) so local hardening is proven.
Purchase Production at Pricing (or request access if self-serve checkout is unavailable). Workspace start uses a secure email link — no password is required to begin.
Open the secure sign-in link from the confirmation email and return to the same workspace. No password is required to begin; you may add one later from the customer console. Then open Console.
Open Downloads and use the runtime package, configuration, and credentials from your workspace package.
On the Linux Docker host: install using the package instructions; confirm runtime health (GET /healthz).
Decision Middleware (OpenClaw supported paid path): on the same host as the licensed Dexgate runtime or a private-network sidecar, install/start @dexgate/decision-middleware. Point it at the runtime authorize URL and put the runtime authorize bearer token on that process only (console runtime-secrets package; see Decision Middleware README for env names). Confirm GET /health on the decide port (default 8787). See OpenClaw quickstart · Decision Middleware.
On the agent host: configure the adapter for the supported path.
- OpenClaw: set toolPolicyMode: "MIDDLEWARE" and decisionMiddlewareUrl (do not put pdpAuthToken in the plugin for MIDDLEWARE). Use your tenant id from the console and a gatewayId you choose for this host (for example gw-dev). Details: console OpenClaw pack + quickstart.
- OpenClaw legacy/advanced only: direct toolPolicyMode=PDP via openclaw-trusted-mode-configure (skips Decision Middleware).
- Codex: configure hosted-runner mode per console package notes, then run the hosted validation turn when authorized.
- Roadmap adapters: only after they are listed as supported in the compatibility matrix.
Day-2 verify: runtime health ok → adapter paid check on licensed runtime → console Deployments healthy → evidence in the customer workspace after one gated action.

What success looks like

Free assess: package self-check + best-effort env fields; claim baseline remains package-only (no Passport)
Paid check: Dexgate policy decision with Action Passport fields on allow/constrain (or explicit deny with reason)
When signing is enabled for your workspace, evidence records can be independently verified (see verification notes in the console-issued package)
OpenClaw paid check: confirms the configured path against the licensed runtime (not free local baseline)
Not success: local free baseline still active after configure, or no authenticated policy decision from the licensed runtime

Validation criteria

A live licensed runtime is required for production validation.
Use your workspace tenant id from the console; choose a stable gatewayId for each agent host (not a console-issued secret).
When signing is enabled, evidence can be independently verified.
Codex paid path uses hosted-runner workflows on supported builds; interactive unrestricted execution is not the governed surface.

When you need more

Multi-environment deployment (development, validation, and production profiles) is available to licensed operators after first paid success. Multi-environment deployment — sign in for the operator guide. Do not start there for first paid success.

See pricing Get started Enterprise rollout guidance Setup prompts for your agent Console downloads Multi-environment deployment