Step-by-Step Fix
1. Confirm You Are Restricted (Not Just Experiencing a Bug)
If you see a message mentioning "unusual activity," "temporary restriction," "account locked," or a countdown timer, you have a security restriction. If you see a generic error without this language, this guide does not apply — see the login not working guide instead.
Note the exact message, any countdown shown, and the timestamp for your support request.
2. Stop All Login Attempts Immediately
Do not attempt to log in again while restricted. Each failed login attempt due to the restriction resets the restriction timer. If the restriction is set for 1 hour and you try again at the 30-minute mark, the timer may restart from the beginning.
Also:
- Do not try multiple browsers or devices simultaneously — the restriction is account-wide, not device-specific
- Do not trigger your OpenClaw agents (they will fail and may log additional failed auth attempts)
- Do not ask team members to attempt login on your behalf
3. Wait Out the Restriction Period
Most OpenClaw temporary restrictions last between 1 and 4 hours. Set a timer and wait without interacting with your account. After the restriction period:
- Use your primary device (the one you most commonly use with OpenClaw)
- Connect from your usual home or office network — not a VPN or a new location
- Use an incognito window with no extensions to eliminate local state issues
- Attempt a single login
If this succeeds, you are unrestricted and can resume normal use.
4. If the Restriction Persists After 4+ Hours, Contact Support
Prepare the following information before contacting support:
- Your OpenClaw account email
- The exact restriction message you saw
- Timestamps of when you noticed the restriction
- Your typical login locations and any recent travel or IP changes
- Whether you recently shared your API key or account credentials
- Whether you ran any high-frequency automation before the restriction appeared
Submit a support request at openclaw.com or post in their Discord #account-help channel.
5. Identify and Fix the Root Cause
After the restriction lifts, investigate what triggered it to prevent recurrence:
If you travel frequently:
- Use OpenClaw's trusted locations setting (if available) to pre-approve your travel locations
- Connect via VPN from your home country's exit node when working abroad
If you run automation from cloud servers:
- Use a static IP for your OpenClaw agent deployments
- Add those IPs to your account's trusted sources if OpenClaw supports this feature
If you had multiple failed login attempts:
- Check whether a browser extension or password manager is auto-submitting incorrect credentials
- Disable auto-fill for OpenClaw login and type credentials manually to avoid lockout loops
If your API key was flagged:
- Review your Anthropic API key usage logs for unexpected spike patterns
- Rotate your key if you suspect it was shared or exposed
6. Configure Preventive Monitoring
Set up alerts so you know immediately if a restriction is triggered:
- Enable failure notifications in OpenClaw for authentication errors
- Set up monitoring on your critical cron jobs to alert within 5 minutes of failure
- Periodically check your Anthropic API usage dashboard for anomalous call patterns that could trigger security flags
Why This Happens
OpenClaw's security system monitors for patterns that correlate with account compromise: API keys being used by multiple parties simultaneously, login attempts from new geographic regions, and high-frequency failed authentication attempts. These signals overlap with legitimate use cases like remote work, team collaboration, and high-frequency automation — which is why restrictions are temporary rather than permanent. The system errs on the side of false positives to protect user accounts from credential theft.
Common Mistakes to Avoid
- Trying to log in repeatedly during a restriction: Every failed attempt extends the restriction duration. The counter-intuitive fix is to stop trying.
- Sharing API keys across team members' personal accounts: This triggers multi-IP usage flags. Use workspace-level API keys in OpenClaw for team automation, not personal account keys.
- Running scripts that simulate human logins instead of using the API: Automated login scripts are a primary trigger for suspicious activity detection. Use OpenClaw's API and proper OAuth flows for programmatic access.
- Not informing support about legitimate high-frequency use: If your business requires high-volume automation from multiple locations, proactively contact support to whitelist your patterns before they trigger restrictions.
FAQ
Q: Will a temporary restriction affect my running agents or just my account login?
A temporary restriction blocks both login and active agents. If a restriction is triggered while agents are running, those runs will fail at their next authentication checkpoint. The agents are not permanently affected — once the restriction lifts, you can log in normally and resume runs. If a critical automation was interrupted, check the run history after the restriction lifts and re-trigger any failed runs manually.
Q: Can I prevent restrictions when traveling internationally?
Yes. Before traveling, log into your OpenClaw account and check if there is a trusted locations or travel notification feature under account security settings. If not, use a VPN set to your home country during travel to maintain a consistent apparent login location. This prevents the geographic anomaly detection from flagging your logins as suspicious. Alternatively, notify OpenClaw support before a planned trip with the countries and dates you will be working from.
Q: My restriction message shows a specific number of minutes to wait. Is that accurate?
The countdown shown is approximate. The restriction timer may extend if additional suspicious signals are detected during the wait period — including checking the OpenClaw status page while logged out can sometimes refresh the detection window. For reliable resolution, wait the full stated time plus an additional 15 minutes, then attempt a single login from your primary device on your home network.
Q: Does a temporary restriction affect my Anthropic API key separately?
No. OpenClaw account restrictions do not affect your Anthropic API key, which is managed separately through console.anthropic.com. Your Anthropic key remains valid during an OpenClaw restriction. The restriction only prevents login to the OpenClaw platform itself — it does not revoke or block your Anthropic API credentials.
Q: How do I set up high-frequency OpenClaw automation without triggering security flags?
For automation that runs more than 100 times per day or from multiple IP addresses, contact OpenClaw support before deploying and ask them to whitelist your use case. Provide your account email, the planned run frequency, the IP range your automation will use, and a brief description of what the automation does. Proactive whitelisting prevents false positive flags and avoids unexpected interruptions to production workflows.
Related Issues
- OpenClaw login/auth issues – session expired
- OpenClaw rate limits affecting runs
- OpenClaw restrictions – blocked commands and safety denials
- OpenClaw login not working on desktop app
Additional FAQ
Q: How do usage limits actually reset — daily or rolling? Most AI platforms use either a fixed daily reset (e.g., at midnight UTC) or a rolling window (e.g., your oldest message from 3 hours ago expires and frees up a slot). Rolling windows are more common for message and request limits because they distribute server load more evenly. Check the platform's help documentation for the exact mechanism — the support page for your specific limit usually specifies the reset type and time zone.
Related Articles
- OpenClaw login / API key fix
- OpenClaw rate limits affecting runs
- OpenClaw agent not starting
- OpenClaw tool calls failing
Additional FAQ
Q: How do usage limits actually reset — daily or rolling? Most AI platforms use either a fixed daily reset (e.g., at midnight UTC) or a rolling window (e.g., your oldest message from 3 hours ago expires and frees up a slot). Rolling windows are more common for message and request limits because they distribute server load more evenly. Check the platform's help documentation for the exact mechanism — the support page for your specific limit usually specifies the reset type and time zone.