OpenClaw Field Guide

Section 7: Setting Up Channels Safely

OpenClaw can connect to multiple chat platforms, so you can talk to your assistant where you already spend time.

Supported channel types commonly include:

  • WhatsApp
  • Telegram
  • Discord
  • iMessage
  • Signal

::: beginner You can run OpenClaw on more than one channel at once. For example, you might use Telegram for testing and WhatsApp for day-to-day use. :::

The most important safety control is who is allowed to talk to your assistant.

  • allowFrom = a list of approved people/accounts
  • If allowFrom is missing, your assistant may accept messages from anyone who can reach that channel endpoint

::: warning If you skip allowFrom, you are effectively leaving the front door unlocked. In public or shared channel setups, that can expose your assistant to unknown users. :::

For group chats, also use requireMention.

  • requireMention: true means the assistant only responds when explicitly tagged/mentioned
  • This prevents it from replying to every message in a busy group

::: tip In groups, combine allowFrom and requireMention for the safest default behavior. :::

Practical setup notes:

  • WhatsApp: usually pairs by scanning a QR code
  • Telegram: often the easiest place to test first
  • Discord: powerful, but usually needs more setup (bot/app config + permissions)
  • iMessage: macOS-only
  • Signal: available, but confirm your environment and plugin setup before relying on it in production

If an unknown person reaches your OpenClaw assistant:

  1. Do not continue the conversation
  2. Add or tighten allowFrom
  3. Enable/confirm requireMention for group contexts
  4. Rotate/recheck channel credentials if exposure is suspected

::: action Audit your channel access list now. If you can't clearly answer "Who can message this assistant?", lock it down before continuing. :::

Example config pattern:

⚙️ Reference only — do not paste this into any file:

{
  "plugins": {
    "entries": {
      "whatsapp": {
        "enabled": true,
        "config": {
          "allowFrom": [
            "+1234567890"
          ],
          "requireMention": true
        }
      }
    }
  }
}