Tokens, Allowlists, and requireMention
Combine tokens, allowFrom allowlists, and group requireMention to control who can reach your assistant.
Tokens, Allowlists, and requireMention is a free OpenClaw Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the OpenClaw Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Three Tools, One Goal
To control who reaches your assistant, you combine three things: tokens, allowlists, and required mentions. Together they form your front line. 🔐
What Tokens Do
A token is a secret that proves a channel or client is allowed to connect to your Gateway. Keep it private, like a house key.
The allowFrom Allowlist
The allowFrom key lists exactly which senders may message OpenClaw on a channel. Anyone not listed is simply ignored.
Allowlist In Config
You set allowFrom inside your channel block. Here a WhatsApp channel only accepts one number, shown in JSON5 config.
{
channels: {
whatsapp: {
allowFrom: ["+15555550123"]
}
}
}Where It Lives
That config sits in ~/.openclaw/openclaw.json. Edit it, and OpenClaw enforces your allowlist the next time it handles messages.
requireMention In Groups
For group chats, requireMention tells OpenClaw to stay quiet unless it is explicitly mentioned, so it never reacts to every message.
requireMention Example
Apply requireMention to all groups with a wildcard so the assistant only speaks when called by name.
{
channels: {
whatsapp: {
groups: { "*": { requireMention: true } }
}
}
}Mention Patterns
Define how to call it with mentionPatterns, like @openclaw. Only messages matching a pattern count as a real mention.
{
messages: {
groupChat: { mentionPatterns: ["@openclaw"] }
}
}Layer Them Together
Each control closes a different gap. Layering tokens, allowFrom, and requireMention is far safer than relying on any single one.
Tokens For Channels
Tokens authenticate the channel connection itself, while allowFrom decides which people behind that channel are trusted to send commands.
Start Strict
A safe habit is to start strict: empty allowlists, mentions required, then add only the senders you truly need over time.
Quick Check
Match each control to what it actually limits.
Recap
Use tokens to authenticate channels, allowFrom to allow senders, and requireMention plus mentionPatterns to stay quiet until called. ✅
Frequently asked questions
Is the “Tokens, Allowlists, and requireMention” lesson free?
Yes — the full text of “Tokens, Allowlists, and requireMention” is free to read here on the web, and the OpenClaw Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the OpenClaw Academy course, upgrade to CoddyKit PRO.
What will I learn in “Tokens, Allowlists, and requireMention”?
Combine tokens, allowFrom allowlists, and group requireMention to control who can reach your assistant. You practise OpenClaw Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start OpenClaw Academy?
No prior experience is required. OpenClaw Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Tokens, Allowlists, and requireMention” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this OpenClaw Academy lesson?
Yes. Every OpenClaw Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why Guardrails Matter
- Tokens, Allowlists, and requireMention
- The Gateway Security Docs
- Remote Access via SSH and Tailscale