Take your agents with you.

Let Cloudflare manage the domain's DNS

If the domain is registered with Cloudflare, continue to step 2.

If it was bought elsewhere, including Squarespace, add the domain to Cloudflare using a full DNS setup. Review imported website, mail, MX, and TXT records before changing nameservers. Disable DNSSEC at the registrar before the nameserver change, wait for Cloudflare to show the zone as Active, then enable DNSSEC again in Cloudflare.

Confirm Companion is ready on your Mac or PC

Open VoiceClaw Realtime Companion, complete Install and Start, and confirm that the runtime is ready. The default local connection listens on 127.0.0.1:12321.

macOS Terminal:

curl -fsS http://127.0.0.1:12321/healthz

Windows PowerShell:

Invoke-RestMethod http://127.0.0.1:12321/healthz

The response should contain {"ok":true}. If you changed the Companion port, use that port in this test and in step 6.

Install cloudflared on macOS or Windows

macOS: Install Cloudflare's tunnel connector with Homebrew, then verify the command. If you do not use Homebrew, use Cloudflare's direct macOS download for your Mac's architecture.

brew install cloudflared
cloudflared --version

Windows: Download the current 64-bit Windows executable from Cloudflare's downloads page, rename it cloudflared.exe, and place it in a stable folder such as C:\Cloudflared\bin. In PowerShell, verify it:

C:\Cloudflared\bin\cloudflared.exe --version

Create a dedicated tunnel

In the Cloudflare dashboard, open Networking > Tunnels, choose Create Tunnel, select the cloudflared connector, and name it something recognizable such as voiceclaw-realtime-watch. Select macOS or Windows and the architecture that matches your computer.

Install the tunnel as a system service

Run the exact service-install command shown by Cloudflare. The token is private: do not paste it into VoiceClaw Realtime, documentation, screenshots, or support messages.

macOS Terminal:

sudo cloudflared service install <TUNNEL_TOKEN>

Windows Command Prompt opened as Administrator:

C:\Cloudflared\bin\cloudflared.exe service install <TUNNEL_TOKEN>

If you saved cloudflared.exe elsewhere, use that path. Wait for the connector to show Healthy. The service lets the tunnel return automatically after the Mac or PC restarts.

Publish the Companion bridge

In the tunnel, add a Published application route. Set the public hostname to your dedicated subdomain, such as watch.example.com, and set the service URL to:

http://127.0.0.1:12321

The public side is HTTPS; the loopback connection from cloudflared to Companion remains local HTTP.

Verify the public HTTPS endpoint

Test the hostname from Terminal or PowerShell. A healthy response contains {"ok":true}. You can also open the health URL from an iPhone on cellular to confirm the path works outside your home network.

macOS Terminal:

curl -fsS https://watch.example.com/healthz

Windows PowerShell:

Invoke-RestMethod https://watch.example.com/healthz

Add the HTTPS origin to Companion

Open Companion > Pair Phone. In Non-Tailscale HTTPS Bridge, enter only the origin, for example https://watch.example.com. Do not add /healthz, another path, or the local port.

Keep Include Bridge Credentials in Setup QR enabled and confirm that the displayed QR code refreshes with the HTTPS origin.

Re-pair iPhone and sync Apple Watch

On iPhone, open VoiceClaw Realtime > Settings > Account > Quick Setup > Scan QR and scan the current Companion code. Then open Settings > General > Watch and press Sync Apple Watch Settings. Keep the Watch nearby and open once so the updated URL and bridge credentials arrive.

Test away from iPhone

Leave the iPhone behind or turn it off, confirm the Watch has Wi-Fi or cellular service, then select a Codex, OpenClaw, or Hermes route that uses your personal HTTPS tunnel. Start with a simple request and confirm that its task state appears on the Watch.