Messaging Channels | NVIDIA NemoClaw

Telegram, Discord, Slack, and WhatsApp reach your OpenClaw or Hermes agent through OpenShell-managed processes and gateway constructs. For token-based channels, NemoClaw registers credentials with OpenShell providers; WhatsApp pairs inside the sandbox via QR scan and intentionally stores mutable session state there. NemoClaw bakes the selected channel configuration into the sandbox image and keeps runtime delivery under OpenShell control.

You can enable channels during nemoclaw onboard or add them later with host-side nemoclaw <sandbox> channels commands. Do not run agent-specific channel mutation commands such as openclaw channels add or openclaw channels remove inside the sandbox because NemoClaw generates /sandbox/.openclaw/openclaw.json for OpenClaw and /sandbox/.hermes/.env for Hermes at image build time, and changes inside the running container do not persist across rebuilds.

nemoclaw tunnel start does not start Telegram, Discord, Slack, or other chat bridges. It only starts optional host services such as the cloudflared tunnel when that binary is present. (nemoclaw start is kept as a deprecated alias.) For details, refer to Commands.

Prerequisites

A machine where you can run nemoclaw onboard (local or remote host that runs the gateway and sandbox).
A token for each token-based messaging platform you want to enable, or a phone you can use to scan the QR code for WhatsApp pairing.
A network policy preset for each enabled channel, or equivalent custom egress rules.

Channel Requirements

Channel	Required tokens	Optional settings
Telegram	`TELEGRAM_BOT_TOKEN`	`TELEGRAM_ALLOWED_IDS` for DM allowlisting, `TELEGRAM_REQUIRE_MENTION` for group-chat replies
Discord	`DISCORD_BOT_TOKEN`	`DISCORD_SERVER_ID`, `DISCORD_USER_ID`, `DISCORD_REQUIRE_MENTION`
Slack	`SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN`	`SLACK_ALLOWED_USERS` for DM and channel `@mention` user allowlisting
WhatsApp	None. Pair via QR after rebuild	None

Telegram uses a bot token from BotFather. Open Telegram, send /newbot to @BotFather, follow the prompts, and copy the token. TELEGRAM_ALLOWED_IDS is a comma-separated list of Telegram user IDs for DM access. Group chats stay open by default so rebuilt sandboxes do not silently drop Telegram group messages because of an empty group allowlist. Set TELEGRAM_REQUIRE_MENTION=1 to make the bot reply in Telegram groups only when users mention it. Pairing and TELEGRAM_ALLOWED_IDS still govern direct messages.

Discord uses a bot token from the Discord Developer Portal. For server channels, enable Developer Mode in Discord, right-click the server, and copy the Server ID into DISCORD_SERVER_ID. By default, NemoClaw configures the bot to reply only when mentioned. Set DISCORD_REQUIRE_MENTION=0 if you want it to reply to all messages in the configured server. Set DISCORD_USER_ID to restrict access to one user; otherwise, any member of the configured server can message the bot.

Slack uses Socket Mode and requires two tokens. Use SLACK_BOT_TOKEN for the bot user OAuth token (xoxb-...) and SLACK_APP_TOKEN for the app-level Socket Mode token (xapp-...). Set SLACK_ALLOWED_USERS to comma-separated Slack member IDs to authorize those users for DMs and for channel @mention events in channels where the Slack app is present. Channel messages still require an explicit bot mention.

WhatsApp Web does not use a host-side token or OpenShell credential provider. NemoClaw advertises WhatsApp for both OpenClaw and Hermes sandboxes, and each agent completes pairing with its own in-sandbox command. Pairing happens inside the sandbox after the rebuild completes and creates mutable session credentials there. Run openshell term and then use the agent-specific pairing command to render the QR code in the terminal:

1 $ openclaw channels login --channel whatsapp  # OpenClaw sandboxes
2 $ hermes whatsapp                             # Hermes sandboxes

Session credentials are generated and stored inside durable agent state (whatsapp for OpenClaw, platforms/whatsapp for Hermes), so they survive rebuilds without re-pairing. This is the runtime tradeoff of enabling WhatsApp without a host bridge: a paired sandbox can use that WhatsApp account until you unpair it or clear the durable state. NemoClaw cannot detect cross-sandbox WhatsApp conflicts the way it does for token-based channels. Pair only one sandbox per WhatsApp account at a time.

Enable Channels During Onboarding

When the wizard reaches Messaging channels, it lists Telegram, Discord, Slack, and WhatsApp. Press a channel number to toggle it on or off, then press Enter when done. If a token is not already in the environment or credential store, the wizard prompts for it and saves it. WhatsApp uses QR pairing instead of a host-side token, so the wizard does not prompt. It prints pairing instructions and you complete the pairing inside the sandbox after rebuild. NemoClaw also selects the matching network policy preset during policy setup so the channel can reach its provider API.

For scripted setup, export the credentials and optional settings for the channels you want to enable before you run onboarding:

1 $ export TELEGRAM_BOT_TOKEN=<your-bot-token>
2 $ export TELEGRAM_REQUIRE_MENTION=1
3 $ export DISCORD_BOT_TOKEN=<your-discord-bot-token>
4 $ export DISCORD_SERVER_ID=<your-discord-server-id>
5 $ export SLACK_BOT_TOKEN=<your-slack-bot-token>
6 $ export SLACK_APP_TOKEN=<your-slack-app-token>
7 $ export SLACK_ALLOWED_USERS=<your-slack-member-id>

Then run onboarding:

1 $ nemoclaw onboard

Complete the rest of the wizard so the blueprint can create OpenShell providers where needed (for example <sandbox>-telegram-bridge), bake channel configuration into the image (NEMOCLAW_MESSAGING_CHANNELS_B64), and start the sandbox.

Add Channels After Onboarding

Run channel commands from the host, not from inside the sandbox. Use channels list to see the supported channel names:

1 $ nemoclaw my-assistant channels list

Add the channel you want:

1 $ nemoclaw my-assistant channels add telegram
2 $ nemoclaw my-assistant channels add discord
3 $ nemoclaw my-assistant channels add slack
4 $ nemoclaw my-assistant channels add whatsapp

channels add collects whatever each channel needs (token prompts for Telegram, Discord, and Slack; a host-side QR scan for WeChat; nothing for WhatsApp because pairing happens in-sandbox after rebuild), registers bridge providers with the OpenShell gateway when tokens were captured, records the channel in the sandbox registry, and asks whether to rebuild immediately. The command accepts mixed-case input such as Telegram, then stores and prints the canonical lowercase channel name. If a matching built-in network policy preset exists, channels add applies it to the sandbox automatically before the rebuild so the bridge has egress to its upstream API; if applying the preset fails, NemoClaw warns and tells you to re-apply manually with nemoclaw <sandbox> policy-add <channel> after the rebuild. Choose the rebuild so the running sandbox image picks up the new channel. If you need optional channel settings such as TELEGRAM_ALLOWED_IDS, TELEGRAM_REQUIRE_MENTION, DISCORD_SERVER_ID, DISCORD_USER_ID, or DISCORD_REQUIRE_MENTION, export them before the rebuild starts. If you defer the rebuild, apply the change later:

1 $ nemoclaw my-assistant rebuild

In non-interactive mode, set the required environment variables before running channels add. Missing credentials fail fast, and the command queues the change for a manual rebuild:

1 $ NEMOCLAW_NON_INTERACTIVE=1 TELEGRAM_BOT_TOKEN=<your-bot-token> \
2   nemoclaw my-assistant channels add telegram
3 $ nemoclaw my-assistant rebuild

For Discord server access after onboarding, include the server settings when you add the channel and rebuild:

1 $ DISCORD_BOT_TOKEN=<your-discord-bot-token> \
2   DISCORD_SERVER_ID=<your-discord-server-id> \
3   DISCORD_REQUIRE_MENTION=1 \
4   nemoclaw my-assistant channels add discord

Rotate or Remove Credentials

Running channels add for a channel that is already configured overwrites the stored tokens and registers the updated bridge provider. Rebuild the sandbox after the update so the image reflects the current channel set.

To remove a channel and clear its stored credentials, run:

1 $ nemoclaw my-assistant channels remove telegram

Use channels stop when you want to pause a bridge without deleting credentials:

1 $ nemoclaw my-assistant channels stop telegram
2 $ nemoclaw my-assistant channels start telegram

Telegram, Discord, and Slack each allow only one active consumer per channel credential. Multiple sandboxes can use the same channel type at the same time when each sandbox uses a distinct bot/app token. For example, two Telegram sandboxes can DM the same TELEGRAM_ALLOWED_IDS account as long as they use different TELEGRAM_BOT_TOKEN values. If you enable a messaging channel and another sandbox already uses the same token, onboarding prompts you to confirm before continuing in interactive mode and exits non-zero in non-interactive mode. If NemoClaw only has legacy channel metadata and cannot compare credential hashes, it keeps the conservative warning; re-run channels add <channel> with the intended token to refresh the stored non-secret hash. nemoclaw status reports cross-sandbox overlaps so you can resolve duplicates before messages start dropping.

Stop Messaging Delivery

Use channels stop when you want to pause one bridge and keep the sandbox running. Use nemoclaw tunnel stop or its deprecated alias nemoclaw stop when you want to stop host auxiliary services and also ask NemoClaw to stop the OpenClaw gateway inside the selected sandbox. Stopping the in-sandbox gateway stops Telegram, Discord, Slack, and WhatsApp polling for that sandbox until you restart the sandbox or gateway.

Confirm Delivery

After the sandbox is running, send a message to the configured bot or app. If delivery fails, use openshell term on the host, check gateway logs, and verify network policy allows the channel API. Use the matching policy preset (telegram, discord, slack, wechat, or whatsapp) or review Common Integration Policy Examples.

Tunnel Command

When the host has cloudflared, nemoclaw tunnel start starts a cloudflared tunnel that can expose the dashboard with a public URL. nemoclaw tunnel stop stops the tunnel and asks NemoClaw to stop the in-sandbox gateway for the selected or default sandbox. The older nemoclaw start still works as a deprecated alias.

1 $ nemoclaw tunnel start

Deploy NemoClaw to a Remote GPU Instance for remote deployment with messaging.
Architecture for how providers, the gateway, and the sandbox fit together.
Commands for channels add, channels remove, channels start, channels stop, tunnel start, tunnel stop, and status.