Connecting OpenClaw to Telegram, step by step

Step 1: get a bot token from BotFather

Your agent appears in Telegram as a bot, and Telegram bots are minted by the official @BotFather account: message it, send /newbot, follow the two prompts (display name, then a unique username ending in bot), and copy the token it hands back. That token is the bot’s identity. Treat it like a password: anyone holding it can impersonate your agent’s Telegram presence. (No Telegram account yet? Creating one needs the phone app once. Everything after, BotFather included, works from a computer.)

Step 2: give the token to OpenClaw

Telegram is deliberately simple in OpenClaw: no login command, just configuration. The minimal config block:

{
  channels: {
    telegram: {
      enabled: true,
      botToken: "123:abc",
      dmPolicy: "pairing",
      groups: { "*": { requireMention: true } }
    }
  }
}

The token can live in the config file (channels.telegram.botToken), in the TELEGRAM_BOT_TOKEN environment variable, or in a token file. Config wins if more than one is set. Then start (or restart) the Gateway and the channel comes up with it.

Step 3: pair yourself

Message your new bot and it won’t answer, by design. The default dmPolicy: "pairing" means unknown senders get a short-lived pairing code (they expire after an hour) instead of a conversation. On the machine running OpenClaw:

openclaw pairing list telegram
openclaw pairing approve telegram <CODE>

After approval, you’re talking to your agent. (If the bot’s reply about codes and “the bot owner” reads confusingly on a first setup, we’ve decoded that message line by line.) This little ceremony is load-bearing security, not friction for its own sake: your bot’s username is guessable public namespace, and pairing is what makes strangers finding it a non-event. The stricter alternative is allowlist (only pre-listed numeric user IDs get through); the open policy answers anyone and belongs nowhere near an agent with real capabilities. In group chats, keep requireMention: true, so the agent only responds when addressed.

Why nothing got exposed just now

Worth appreciating: you just gave your agent a public face without opening a single port. OpenClaw’s Telegram channel uses long polling by default: the Gateway dials out to Telegram’s API and asks for new messages; Telegram never connects in. No public URL, no webhook, no firewall change, no Gateway on the internet. (A webhook mode exists for operators who want push delivery, but it requires deliberately standing up public ingress. If you’re asking whether you need it, you don’t.)

This is also the pattern to internalize about OpenClaw channels generally: daily conversation flows through outbound connections to chat services, which is why a well-set-up agent needs no inbound exposure at all. On an Everpod pod, connecting Telegram is guided step by step: you bring the BotFather token, and nothing on the pod is ever exposed to the internet.