diff --git a/ui/src/lib/agent-onboarding-prompt.ts b/ui/src/lib/agent-onboarding-prompt.ts
index 99e9308ceb0..3da1b65967e 100644
--- a/ui/src/lib/agent-onboarding-prompt.ts
+++ b/ui/src/lib/agent-onboarding-prompt.ts
@@ -56,7 +56,11 @@ OpenClaw Gateway note:
 If you are an OpenClaw Gateway agent, use \`adapterType: "openclaw_gateway"\`, set \`agentDefaultsPayload.url\` to your \`ws://\` or \`wss://\` gateway URL, and include \`agentDefaultsPayload.headers["x-openclaw-token"]\` with your gateway token. Do not use \`/v1/responses\` or \`/hooks/*\` in that join flow.
 
 Hermes Gateway note:
-If you are a Hermes Gateway agent, use \`adapterType: "hermes_gateway"\`. Start Hermes with \`API_SERVER_ENABLED=true\`, \`API_SERVER_KEY=<random-gateway-key>\`, and \`hermes gateway run --replace --accept-hooks\`; the default Hermes API server port is \`8642\`. Set \`agentDefaultsPayload.apiBaseUrl\` to the Hermes gateway URL Paperclip can reach and \`agentDefaultsPayload.paperclipApiUrl\` to the Paperclip base URL Hermes can reach. For local loopback use \`http://127.0.0.1:8642\`; for LAN/private network use \`http://<private-ip>:8642\`; for a private overlay use \`http://<tailnet-host>:8642\`; from Docker use \`http://host.docker.internal:8642\`; behind reverse proxy/TLS use \`https://hermes-gateway.example\`. \`hermes_local\` runs Hermes on the Paperclip host; \`hermes_gateway\` calls an already-running Hermes API server; Hermes-originated Paperclip API calls use the claimed \`PAPERCLIP_API_KEY\` and \`PAPERCLIP_API_URL\`, not \`agentDefaultsPayload.apiBaseUrl\`.
+If you are a Hermes Gateway agent, use \`adapterType: "hermes_gateway"\`.
+- Start Hermes with \`API_SERVER_ENABLED=true\` and \`API_SERVER_KEY=<random-gateway-key>\`, then run \`hermes gateway run --replace --accept-hooks\`. The default Hermes API server port is \`8642\`.
+- Set \`agentDefaultsPayload.apiBaseUrl\` to the Hermes gateway URL Paperclip can reach, \`agentDefaultsPayload.apiKey\` to the same value as \`API_SERVER_KEY\`, and \`agentDefaultsPayload.paperclipApiUrl\` to the Paperclip base URL Hermes can reach.
+- \`apiBaseUrl\` examples: local loopback \`http://127.0.0.1:8642\`; LAN/private network \`http://<private-ip>:8642\`; private overlay \`http://<tailnet-host>:8642\`; Docker \`http://host.docker.internal:8642\`; reverse proxy/TLS \`https://hermes-gateway.example\`.
+- Three distinct uses to keep apart: \`hermes_local\` runs Hermes on the Paperclip host; \`hermes_gateway\` calls an already-running Hermes API server via \`apiBaseUrl\`; Hermes-originated Paperclip API calls use the claimed \`PAPERCLIP_API_KEY\` and \`PAPERCLIP_API_URL\`, not \`agentDefaultsPayload.apiBaseUrl\`.
 
 After you have connected to Paperclip, review and follow the full onboarding instructions in onboarding.txt.
 `;