Your OpenClaw, on the go. Prepare a connection your iPhone can reach, then pair Miracles with your gateway. We recommend Tailscale for private setups.
Miracles is the native iPhone/iPad client for your existing OpenClaw gateway; a hosted gateway or AI account is not included. Connecting and regular chats do not require Miracles Pro.
Before you begin
An iPhone or iPad with iOS or iPadOS 26 or later and the free Miracles app.
Your own running OpenClaw server (gateway) with an agent. It can use a local model, for example with Ollama, or an AI provider you choose. A paid AI provider is not required; local models need suitable hardware.
An HTTPS/WSS address reachable from your iPhone, with a valid, trusted TLS certificate. Tailscale is recommended, not required.
Check the capabilities of your installed OpenClaw version. The gateway computer must remain powered on and reachable.
YOUR ROUTE TO THE GATEWAY
Different routes. One secure connection.
Tailscale is our recommendation, not a requirement. Miracles connects to your OpenClaw gateway over HTTPS/WSS — using the network route that works for you.
Private · at home and away
Keep your gateway private.
Our recommended starting point for a personal setup: Tailscale connects your iPhone or iPad and gateway computer in a private network. The devices do not need to be on the same Wi-Fi — it works when you are away too. Tailscale Serve provides the secure gateway address — without router port forwarding or a publicly exposed gateway.
Install Tailscale on your iPhone or iPad and on the computer running OpenClaw. Connect both devices to the same private Tailscale network (a “tailnet”); its access rules must allow the connection.
Tailscale Serve with a valid HTTPS address pointing to the correct gateway port. The gateway can stay bound to loopback.
Keep Tailscale connected on your mobile device while using this private route — even on the same Wi-Fi as the gateway computer. Miracles does not install or activate Tailscale for you. The Personal plan is intended for personal use; business use has separate terms.
No VPN · managed setups
Your own secure internet address.
A publicly reachable gateway can be used without Tailscale. A properly configured reverse proxy or Cloudflare Tunnel provides its HTTPS/WSS address. This requires a deliberately secured gateway deployment.
What you need
A valid TLS certificate and WebSocket support all the way to the gateway.
Keep gateway authentication and device pairing enabled; no anonymous access. Configure proxy trust using your installed OpenClaw documentation.
The address must be directly reachable by the native client: no browser sign-in gate or additional Access service-token headers.
Private · existing network
Use the access you already have.
Another VPN can provide the network route too, such as an existing WireGuard setup. Miracles uses the reachable gateway address, not a specific VPN app.
What you need
Your iPhone VPN must provide DNS and routing to the gateway, with firewall rules that permit access.
You still need HTTPS/WSS with a certificate trusted by your iPhone and matching the hostname, in addition to the VPN.
Gateway authentication and device approval remain necessary. Your particular VPN configuration needs its own verification.
At home · on the same network
Connect within your own network.
You can use Miracles on the same local network without Tailscale or another VPN if a separate, secure HTTPS/WSS endpoint for the gateway has been set up there. Being on the same Wi-Fi alone is not enough and does not replace a Tailscale connection to a private Tailscale Serve address. Outside that network you will need one of the other routes.
What you need
Your iPhone and gateway must be able to reach each other. Allow local network access in iOS if prompted.
An HTTPS/WSS address with a valid certificate trusted by your iPhone; unencrypted WS is rejected on a LAN too.
A gateway bound only to localhost cannot be reached directly from iPhone. Use a suitably restricted TLS proxy or a deliberately configured network binding — with authentication.
Whichever route you choose
Your gateway must be reachable from your iPhone and speak the OpenClaw protocol supported by Miracles. Its address needs a valid TLS certificate trusted by your device. HTTPS is used as WSS; unencrypted HTTP/WS is not accepted. A VPN does not replace this TLS connection.
Your network route is not your sign-in method.
The network gets you to the gateway. Sign in with a setup code, gateway token or password, as configured on your gateway. “Tailscale identity” is a separate sign-in option that the gateway must explicitly support; Tailscale alone replaces neither authentication nor device approval. These credentials sign your device in to the server. They are not AI-provider API keys and do not unlock paid Miracles features. Once paired, Miracles uses its own device token.
Miracles does not configure a VPN or tunnel for you. Browser-based access gates, such as an interactive Cloudflare Access sign-in, and additional proxy authentication are not supported setup routes. A TLS proxy’s operator is part of your data path; review its access and privacy settings.
01
Prepare your network route
Choose a connection option above. If you are starting fresh, we recommend Tailscale on iPhone and the gateway computer with Tailscale Serve. An existing suitable HTTPS endpoint, another VPN or your LAN can also be used.
Verify that the HTTPS/WSS address is reachable from iPhone and uses a valid TLS certificate. Miracles does not configure the network infrastructure itself. Your network route and the gateway sign-in that follows are separate choices.
02
Pair your iPhone
Tap “Set up Miracles”, then “Let’s get started”. After preparation, “I have my connection details” takes you to manual entry or the QR scanner. Open your OpenClaw Web UI → Settings → Devices → Pair device and choose Full access, then select Create setup code. Leave that page open. Scan the QR code or use manual entry.
Guided setup reads the address from a valid QR or setup code. Check it and tap “Connect securely”. Then confirm permission to connect to this gateway; this is separate from the later AI data sharing consent. Manual entry is available in the same setup step: setup code, gateway token, password or explicitly supported Tailscale identity. The separate “How to set up Miracles” button opens the explanation.
In older OpenClaw versions, look for “Pair mobile device”. “New code” replaces an existing code. If your version only shows a gateway address and token or password, enter those manually using the matching sign-in method.
03
Approve. Say hello.
If the gateway requires device approval, Miracles shows a dedicated waiting screen. In OpenClaw, check the Miracles request and device fingerprint, then approve your device. Miracles checks automatically while the app stays open. Some setup codes already confirm pairing directly.
After confirmed connection, AI data sharing opens. Review the information and explicitly decide whether to allow content sharing. Only then does your conversation space open. Choose an agent and conversation and check a harmless test message and reconnection.
Your agent can help.
Copy this request into your private conversation with your OpenClaw agent. It should check the actual setup and guide you through the steps for your installation.
Miracles is a native iPhone/iPad client for chats and voice conversations with agents on my own OpenClaw gateway. It connects directly to that gateway; it provides neither a hosted gateway nor an AI account. Help me connect it.
Use the installed documentation to check the active gateway instance, version, authentication and existing network route. Miracles needs HTTPS/WSS reachable from iPhone with a valid, trusted TLS certificate, without a browser sign-in gate or extra proxy-auth headers. Reuse a suitable existing route; Tailscale Serve is recommended for a new private route. Discuss any required network changes with me before applying them; preserve authentication and existing routes and back up settings you change. For setup codes, also check the reachable gateway address they contain and, where supported, plugins.entries.device-pair.config.publicUrl.
Guide me through Devices → Pair device → Full access → Create setup code or the appropriate gateway-token or password sign-in, depending on version. I will enter credentials only in Miracles, not in chat. Match any pending device approval to my attempt and fingerprint. I will then review and confirm AI data sharing in Miracles myself. Test a harmless message and reconnection with me. If you lack access, explain the specific manual steps.
AI data sharing in Miracles
After the gateway confirms connection, guided setup opens AI data sharing automatically. You can review it again later in Settings → AI data sharing. Miracles retrieves the gateway configuration and shows possible AI providers and configured server addresses. No recipient file or extra gateway installation is required. Only your separate consent enables sending. Photos and files remain in your local draft until Send.
What the information covers
The display describes possible routes from configuration and the model catalog, not every recipient of each message. Tools, extensions and proxies may use additional recipients. Miracles cannot automatically verify custom endpoint operators or terms. Review your gateway services before sending sensitive content. Detected changes to displayed routes require new consent; external changes cannot be fully detected. Sending remains blocked if configuration cannot be retrieved.
Ready to go?
Send a harmless test message and check that your agent replies. Briefly switch to another app, then return and check reconnection.
If you want to use Miracles away from home, also test without your home Wi-Fi. Keep Tailscale connected when using a private Tailscale route.
An expired or incomplete setup code needs a fresh code. An unreachable address needs a working network route instead — pairing again will not fix that.
Miracles