Backup OpenClaw state directory and workspace. Includes excluding sensitive files, packaging for backup. Triggered when user asks to backup, export, or save state.
Backup OpenClaw state directory and workspace. Includes excluding sensitive files, packaging for backup. Triggered when user asks to backup, export, or save state.
Safe Backup
Backup OpenClaw state directory and workspace with security best practices.
⚠️ Security Warnings
Backup may contain sensitive data - review before sharing
If uploading to GitHub - use a private repository and consider encryption
auth-profiles.json is EXCLUDED - after restore, you must re-authenticate
This script does NOT automatically push to any remote
The script automatically detects the appropriate temp directory for each platform:
Platform
Temp Directory
Environment Variable
Linux
/tmp
-
macOS
/var/folders/xx/...
$TMPDIR
Windows (Git Bash)
C:\Users\xxx\AppData\Local\Temp
$TEMP / $TMP
2. rsync Dependency
The script uses rsync for efficient file copying:
Linux/macOS: ✅ Built-in
Windows: ⚠️ Git Bash includes rsync
If rsync is not available, the script will fail. For Windows without Git Bash, you need to install rsync separately (e.g., via MSYS2 or Cygwin).
3. Path Separators
The script uses Unix-style forward slashes (/). This works in:
Linux ✅
macOS ✅
Git Bash ✅
WSL ✅
Native Windows CMD uses backslashes (\) and won't work without modifications.
4. Home Directory Detection
The script uses $HOME environment variable:
Linux: /home/username
macOS: /Users/username
Windows (Git Bash): C:\Users\username
This works correctly in all supported platforms.
Migration Checklist
When migrating from one platform to another:
Run backup on source machine
Transfer backup file securely (USB, encrypted cloud, etc.)
Install Git Bash (Windows) or ensure bash is available
Install OpenClaw on target machine
Run restore script
Re-authenticate all services (credentials are not backed up)
Platform-Specific Notes
Windows (Git Bash)
# Run from Git Bash, NOT CMD or PowerShell
~/.openclaw/skills/safe-backup/scripts/backup.sh
If you get "rsync not found", install Git for Windows with all optional Unix tools.
macOS
# Native bash is available
~/.openclaw/skills/safe-backup/scripts/backup.sh
Temp directory will be in $TMPDIR (e.g., /var/folders/xx/...).
Linux
# Native bash is available
~/.openclaw/skills/safe-backup/scripts/backup.sh
Temp directory will be /tmp.
What Gets Backed Up
✅ Included (Safe to Backup)
Directory
Contents
~/.openclaw/
OpenClaw configuration
~/.openclaw/workspace/
Agent workspace files
agents/
Agent definitions
skills/
Installed skills
memory/
Memory files
hooks/
Custom hooks
❌ Excluded (Sensitive - Not Backed Up)
Pattern
Reason
*.log
Log files
*.log.*
Log rotation files
sessions.json
Session data
logs/
Log directory
auth-profiles.json
API tokens & credentials
.env
Environment variables
*.pem, *.key
TLS/SSH keys
credentials.json
Stored credentials
api-keys.json
API keys
sessions/
Runtime sessions
browser/
Browser cache
canvas/
Canvas cache
media/
Temporary media files
backups/
Backup directory itself
delivery-queue/
Runtime queue
devices/
Device cache
subagents/
Runtime subagents
completions/
Auto-completion cache
*.bak
Backup files
*.save
Save files
update-check.json
Update check cache
Complete Workflow
Use Cases
Scenario
Recommended Solution
Description
Regular Backup
Local encrypted storage
Weekly backup, store in encrypted local directory
Migrate to New Machine
Local tarball + USB
Transfer between machines, avoid network transmission
Cloud Disaster Recovery
Private GitHub repo
Private repo + encryption, for offsite backup
Server Environment
rsync to backup server
Automated periodic sync, suitable for production
Phase 1: Backup
# Step 1: Run backup
~/.openclaw/skills/safe-backup/scripts/backup.sh
# Step 2: Find output path (check the last line of output)# The script will display: "Backup file: /path/to/safe-backup-YYYYMMDD.tar.gz"# Step 3: Verify backup contents
tar -tzf "$(ls -t /tmp/safe-backup-*.tar.gz | head -1)" | head -20
# Or use the exact path shown in output:# tar -tzf /tmp/safe-backup-20260223.tar.gz | head -20
Phase 2: Storage
Choose one:
Option A: Local Encrypted Storage (Recommended)
# Find the latest backup file
BACKUP_FILE=$(ls -t /tmp/safe-backup-*.tar.gz | head -1)
# Create encrypted archive
openssl enc -aes-256-cbc -salt -in"$BACKUP_FILE" -out ~/backups/safe-backup-$(date +%Y%m%d).tar.gz.enc
# Enter a strong password when prompted# Delete unencrypted backuprm"$BACKUP_FILE"
Option B: Private GitHub Repository
# One-time setup: Create private repo on GitHub# Find the latest backup file
BACKUP_FILE=$(ls -t /tmp/safe-backup-*.tar.gz | head -1)
# Clone your private repo
git clone https://github.com/YOUR_USERNAME/safe-backup.git ~/safe-backup
# Extract backupmkdir -p ~/safe-backup/$(date +%Y-%m-%d)
tar -xzf "$BACKUP_FILE" -C ~/safe-backup/$(date +%Y-%m-%d)/
# Commit and pushcd ~/safe-backup
git add .
git commit -m "Backup $(date +%Y-%m-%d)"
git push origin main
# Delete local copyrm -rf ~/safe-backup
rm"$BACKUP_FILE"
Option C: rsync to Remote Server
# Example: sync to remote server
rsync -avz --delete \
--exclude='*.log' \
--exclude='sessions.json' \
~/.openclaw/ user@backup-server:/path/to/backups/
Phase 3: Restore
Step 1: Locate Backup
# If encrypted
openssl enc -aes-256-cbc -d -in ~/backups/safe-backup-20260223.tar.gz.enc -out /tmp/safe-backup.tar.gz
# If plain tarball, find the file# Check your backup location (USB, cloud download, etc.)cp /path/to/your/backup/safe-backup-20260223.tar.gz /tmp/
Step 2: Stop Gateway
systemctl --user stop openclaw-gateway
Step 3: Restore Files
# Determine temp directory based on platformif [[ -n "$TMPDIR" ]]; then
TEMP_DIR="$TMPDIR"elif [[ -n "$TEMP" ]]; then
TEMP_DIR="$TEMP"elif [[ -n "$TMP" ]]; then
TEMP_DIR="$TMP"else
TEMP_DIR="/tmp"fi# Extract to temporary locationmkdir -p "$TEMP_DIR/restore"
tar -xzf "$TEMP_DIR/safe-backup.tar.gz" -C "$TEMP_DIR/restore"# Restore state directorycp -r "$TEMP_DIR/restore/state/"* ~/.openclaw/
# Restore workspace (if needed)cp -r "$TEMP_DIR/restore/workspace/"* ~/.openclaw/workspace/
Step 4: Re-authenticate
Because auth-profiles.json was excluded, you must re-configure:
# Edit config to add authentication
openclaw config edit
# Or manually create auth-profiles.json
nano ~/.openclaw/agents/main/agent/auth-profiles.json
Required re-configuration:
Telegram bot token
Discord bot token
Feishu credentials
Any other API keys
Step 5: Restart Gateway
systemctl --user start openclaw-gateway
# Verify
openclaw status