Allowlist — OpenClaw Glossary
A security list of approved identifiers (like User IDs or IP addresses) that are granted access to a system. Anyone not on the list is automatically denied access by default.
On this page
Allowlist ek VIP guest list ki tarah hoti hai. Sirf wahi log aapke bot se baat kar sakte hain jinka User ID is list mein hoga. Agar koi anjaan user bot ko message bhejega, toh bot usko ignore kar dega. AI tools ke security ke liye ye bahut zaroori hai.
What is an Allowlist?
An allowlist (sometimes called a whitelist) is an access control mechanism. It works by establishing a strict rule: “Deny everyone by default, except for the specific people on this list.”
In the context of OpenClaw and Telegram, an allowlist is a list of numeric Telegram User IDs.
Why it matters for OpenClaw
Unlike a simple customer service chatbot, an OpenClaw agent is powerful. Depending on the tools you have enabled, the agent might be able to read files, modify your server, or spend your AI provider credits.
If you connect a Telegram bot to OpenClaw, anyone on Telegram can search for your bot’s username and send it a message. If you do not have an allowlist, the agent will process their message, potentially executing tools on their behalf.
By configuring TELEGRAM_ALLOWLIST in your .env file, the Gateway checks the sender’s User ID against the list before processing the message. If they are not on the list, the message is silently dropped.
Common mistake
Using @usernames instead of numeric IDs.
When configuring the allowlist in OpenClaw, users often put their text username (e.g., @clawbuilder). This will not work. The Telegram API uses permanent numeric User IDs for authorization. Text usernames can be changed, making them insecure for access control.
Fix: Use a bot like @userinfobot on Telegram to find your numeric ID (e.g., 123456789), and use that in your .env file: TELEGRAM_ALLOWLIST=123456789.
Related guides
ClawReady.in is an independent educational resource and setup service. It is not affiliated with, endorsed by, or operated by OpenClaw.