โทเค็น รายชื่ออนุญาต และ requireMention

To control who reaches your assistant, you combine three things: tokens, allowlists, and required mentions. Together they form your front line. 🔐

A token is a secret that proves a channel or client is allowed to connect to your Gateway. Keep it private, like a house key.

The allowFrom key lists exactly which senders may message OpenClaw on a channel. Anyone not listed is simply ignored.

You set allowFrom inside your channel block. Here a WhatsApp channel only accepts one number, shown in JSON5 config.

That config sits in ~/.openclaw/openclaw.json. Edit it, and OpenClaw enforces your allowlist the next time it handles messages.

For group chats, requireMention tells OpenClaw to stay quiet unless it is explicitly mentioned, so it never reacts to every message.

Apply requireMention to all groups with a wildcard so the assistant only speaks when called by name.

Define how to call it with mentionPatterns, like @openclaw. Only messages matching a pattern count as a real mention.

Each control closes a different gap. Layering tokens, allowFrom, and requireMention is far safer than relying on any single one.

Tokens authenticate the channel connection itself, while allowFrom decides which people behind that channel are trusted to send commands.

A safe habit is to start strict: empty allowlists, mentions required, then add only the senders you truly need over time.

Use tokens to authenticate channels, allowFrom to allow senders, and requireMention plus mentionPatterns to stay quiet until called. ✅