OpenClaw Telegram Allowlist Guide

By default, creating a Telegram bot means anyone on Telegram can search for its username and message it. OpenClaw relies on Direct Message Policies (dmPolicy) and Allowlists to prevent unauthorized access.

Understanding dmPolicy

In your OpenClaw .env file, the TELEGRAM_DM_POLICY variable dictates how your bot responds to Direct Messages.

There are three options:

• strict: The bot ignores all messages from users not on the allowlist or without an active paired session. (Recommended).
• pairing: The bot prompts unknown users to enter a pairing code.
• public: DANGEROUS. The bot responds to everyone and allows anyone to execute tools. Never use this in production.

For a personal bot, set your policy to strict:

1 TELEGRAM_DM_POLICY=strict

Configuring the Allowlist

To let yourself bypass the strict policy, you must add your Telegram User ID to the allowlist.

1. Find your Telegram ID

You need your numeric Telegram User ID (e.g., 123456789), not your @username. You can find this by messaging userinfobot on Telegram.

2. Update the .env file

Open your .env file and locate the TELEGRAM_ALLOWLIST variable. It expects a comma-separated list of User IDs.

1 TELEGRAM_ALLOWLIST=123456789,987654321

3. Restart the Gateway

For the changes to take effect, restart your OpenClaw Gateway:

1 pm2 restart openclaw-gateway

Group Chat Allowlists

If you add your OpenClaw bot to a Telegram Group, the dmPolicy applies differently. By default, bots in groups only process messages that explicitly @mention them or start with a slash /.

However, OpenClaw also supports a TELEGRAM_GROUP_ALLOWLIST.

If you want the bot to only operate in specific groups (e.g., your company’s internal dev chat), find the Group ID (which usually starts with a -, like -100123456789) and add it to your .env:

1 TELEGRAM_GROUP_ALLOWLIST=-100123456789

Maintenance checklist

• Review the allowed users in your .env file periodically.
• Remove IDs for people who no longer need access (e.g., former employees or contractors).
• Recheck your group allowlists after moving the bot into a new group to ensure you haven’t accidentally granted access to a public chat.