Allowlisting Senders with allowFrom
Use channels. .allowFrom to restrict who is allowed to message your assistant.
Allowlisting Senders with allowFrom is a free OpenClaw Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the OpenClaw Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Who Can Reach You
OpenClaw has full system access, so you decide who may message it. The allowlist is your front door, and only listed people get in. 🔐
Meet allowFrom
The key for this is allowFrom. It lives inside a channel block and holds the senders you trust to talk to your assistant.
channels: {
whatsapp: {
allowFrom: []
}
}Where It Sits
The full path is channels.platform.allowFrom. Swap platform for whatsapp, telegram, or any channel you have connected.
It Is a List
allowFrom takes a list of senders. For WhatsApp that means phone numbers, so each entry is one trusted contact.
allowFrom: ["+15555550123"]Adding More Senders
Need more people? Just add more entries to the list. Every number you include can message and command your assistant.
allowFrom: [
"+15555550123",
"+15555550199"
]A Full WhatsApp Block
Here is allowFrom inside a real whatsapp block. This is the shape you edit in openclaw.json to gate the channel.
channels: {
whatsapp: {
allowFrom: ["+15555550123"]
}
}Why Allowlisting First
Allowlisting is the simplest guardrail. Before any clever rules, deciding who is on the list keeps strangers from driving your machine.
Per Channel
Each channel keeps its own allowFrom. Your WhatsApp list and your Telegram list are separate, so you tune access per platform.
Use the Right Format
Match the sender format the platform expects. For WhatsApp use full international numbers, including the country code, so they match correctly.
Apply Your Changes
After editing allowFrom, save the file and restart OpenClaw. The new list takes effect once the assistant reloads its config.
Trust by Design
Keep the list tight. Add only people you truly trust, because everyone on it can ask your assistant to act on your system.
Quick Check
Test your grip on the allowlist key.
Recap
You set the guest list: allowFrom names the senders allowed per channel. Tight lists keep you safe. Next, group mention rules. ✅
Frequently asked questions
Is the “Allowlisting Senders with allowFrom” lesson free?
Yes — the full text of “Allowlisting Senders with allowFrom” is free to read here on the web, and the OpenClaw Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the OpenClaw Academy course, upgrade to CoddyKit PRO.
What will I learn in “Allowlisting Senders with allowFrom”?
Use channels. .allowFrom to restrict who is allowed to message your assistant. You practise OpenClaw Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start OpenClaw Academy?
No prior experience is required. OpenClaw Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Allowlisting Senders with allowFrom” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this OpenClaw Academy lesson?
Yes. Every OpenClaw Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- The openclaw.json Config File
- Allowlisting Senders with allowFrom
- Group Rules with requireMention and mentionPatterns
- Defaults When You Configure Nothing