How to Pair OpenClaw DM Senders

DM pairing is one of OpenClaw’s most important safety features because messaging channels are untrusted input by default. When a channel uses dmPolicy pairing, an unknown sender gets a short code, but the agent does not process their message until you approve. That is exactly the behavior you want for a real assistant connected to real chat surfaces.

When this is the right move

Use pairing as the default for personal channels and production bots unless you have a very deliberate allowlist or open policy. It is especially important for Telegram, WhatsApp, Signal, iMessage, Microsoft Teams, Discord, Google Chat, and Slack, where inbound messages can trigger tools or expose context if you let the wrong sender through.

The practical workflow

1. Keep dmPolicy set to pairing for the channel unless you have a strong reason to use allowlist, open, or disabled.
2. When someone new messages the bot, ask them for the code the bot sent. Do not process their original message until the approval is complete.
3. List pending requests for the channel and inspect the sender before approving.
4. Approve the exact current code. Pairing requests expire after one hour and only a limited number are pending per channel by default.
5. After approval, send a low-risk test message before trusting the channel for sensitive actions.

Grounded command or config pattern

The pairing docs show channel-specific list and approve commands. Telegram is the example, but the pattern applies to supported channels.

openclaw pairing list telegram
openclaw pairing approve telegram <CODE>
openclaw doctor

Supported pairing channels documented include bluebubbles, discord, feishu, googlechat, imessage, irc, line, matrix, mattermost, msteams, nextcloud-talk, nostr, openclaw-weixin, signal, slack, synology-chat, telegram, twitch, whatsapp, zalo, and zalouser.

Operator notes

Pairing state lives under ~/.openclaw/credentials. Pending requests use channel pairing JSON files, and approved allowlists use channel/account-scoped allowFrom files. Treat those files as sensitive because they gate who can talk to the assistant. Back them up like credentials, not like disposable cache.

Rollout approach

For pair openclaw dm senders, I would make the first pass deliberately small: one owner, one machine or channel, one visible test, and one rollback path. OpenClaw features become powerful when they connect to real tools and real messages, so the safest rollout is not a giant configuration day. It is a short rehearsal that proves the docs-grounded path works in your exact workspace before you depend on it while busy.

Common mistake

The common mistake is treating the command as the whole feature. The command starts the workflow, but the surrounding state is what keeps it reliable: config validation, auth, pairing, permissions, logs, and a tiny verification step. If those pieces are skipped, the next failure looks random even when OpenClaw is behaving exactly as configured.

Maintenance rhythm

Once this is working, write down the exact command, config path, or approval decision you used. Future you will not remember the tiny detail that made the setup safe. A small note in the workspace or runbook is cheaper than rediscovering the same behavior during an outage, especially after updates or machine changes.

Safety checks

Do not switch to dmPolicy open just because pairing feels inconvenient. The docs require allowFrom ["*"] for public inbound DMs, which should be an explicit opt-in. Also remember group access is separate. Approving a DM sender does not mean they should control the bot in a group, thread, or shared workspace.

How to verify it worked

After approval, the sender should be able to message the bot without receiving a new pairing prompt. If they still cannot, check whether they messaged a different account, whether the pending code expired, and whether the channel is using account-scoped allowlist files.

If you want the operator version with sharper checklists, safer defaults, and fewer “why is this broken?” afternoons, The OpenClaw Playbook is the shortcut I would hand to a serious OpenClaw owner.