> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt. > For full documentation content, see https://docs.nvidia.com/nemoclaw/llms-full.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server. # Messaging Channels > Connect Telegram, Discord, Slack, or WhatsApp to your sandboxed OpenClaw or Hermes agent using OpenShell-managed channel messaging. Telegram, Discord, Slack, and WhatsApp reach your OpenClaw or Hermes agent through OpenShell-managed processes and gateway constructs. For token-based channels, NemoClaw registers credentials with OpenShell providers; WhatsApp pairs inside the sandbox via QR scan and intentionally stores mutable session state there. NemoClaw bakes the selected channel configuration into the sandbox image and keeps runtime delivery under OpenShell control. You can enable channels during `nemoclaw onboard` or add them later with host-side `nemoclaw channels` commands. Do not run agent-specific channel mutation commands such as `openclaw channels add` or `openclaw channels remove` inside the sandbox because NemoClaw generates `/sandbox/.openclaw/openclaw.json` for OpenClaw and `/sandbox/.hermes/.env` for Hermes at image build time, and changes inside the running container do not persist across rebuilds. `nemoclaw tunnel start` does not start Telegram, Discord, Slack, or other chat bridges. It only starts optional host services such as the cloudflared tunnel when that binary is present. (`nemoclaw start` is kept as a deprecated alias.) For details, refer to [Commands](/reference/commands). ## Prerequisites * A machine where you can run `nemoclaw onboard` (local or remote host that runs the gateway and sandbox). * A token for each token-based messaging platform you want to enable, or a phone you can use to scan the QR code for WhatsApp pairing. * A network policy preset for each enabled channel, or equivalent custom egress rules. ## Channel Requirements | Channel | Required tokens | Optional settings | | -------- | ------------------------------------ | --------------------------------------------------------------------------------------------- | | Telegram | `TELEGRAM_BOT_TOKEN` | `TELEGRAM_ALLOWED_IDS` for DM allowlisting, `TELEGRAM_REQUIRE_MENTION` for group-chat replies | | Discord | `DISCORD_BOT_TOKEN` | `DISCORD_SERVER_ID`, `DISCORD_USER_ID`, `DISCORD_REQUIRE_MENTION` | | Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | `SLACK_ALLOWED_USERS` for DM and channel `@mention` user allowlisting | | WhatsApp | None. Pair via QR after rebuild | None | Telegram uses a bot token from [BotFather](https://t.me/BotFather). Open Telegram, send `/newbot` to [@BotFather](https://t.me/BotFather), follow the prompts, and copy the token. `TELEGRAM_ALLOWED_IDS` is a comma-separated list of Telegram user IDs for DM access. Group chats stay open by default so rebuilt sandboxes do not silently drop Telegram group messages because of an empty group allowlist. Set `TELEGRAM_REQUIRE_MENTION=1` to make the bot reply in Telegram groups only when users mention it. Pairing and `TELEGRAM_ALLOWED_IDS` still govern direct messages. Discord uses a bot token from the Discord Developer Portal. For server channels, enable Developer Mode in Discord, right-click the server, and copy the Server ID into `DISCORD_SERVER_ID`. By default, NemoClaw configures the bot to reply only when mentioned. Set `DISCORD_REQUIRE_MENTION=0` if you want it to reply to all messages in the configured server. Set `DISCORD_USER_ID` to restrict access to one user; otherwise, any member of the configured server can message the bot. Slack uses Socket Mode and requires two tokens. Use `SLACK_BOT_TOKEN` for the bot user OAuth token (`xoxb-...`) and `SLACK_APP_TOKEN` for the app-level Socket Mode token (`xapp-...`). Set `SLACK_ALLOWED_USERS` to comma-separated Slack member IDs to authorize those users for DMs and for channel `@mention` events in channels where the Slack app is present. Channel messages still require an explicit bot mention. WhatsApp Web does not use a host-side token or OpenShell credential provider. NemoClaw advertises WhatsApp for both OpenClaw and Hermes sandboxes, and each agent completes pairing with its own in-sandbox command. Pairing happens inside the sandbox after the rebuild completes and creates mutable session credentials there. Run `openshell term` and then use the agent-specific pairing command to render the QR code in the terminal: ```console $ openclaw channels login --channel whatsapp # OpenClaw sandboxes $ hermes whatsapp # Hermes sandboxes ``` Session credentials are generated and stored inside durable agent state (`whatsapp` for OpenClaw, `platforms/whatsapp` for Hermes), so they survive rebuilds without re-pairing. This is the runtime tradeoff of enabling WhatsApp without a host bridge: a paired sandbox can use that WhatsApp account until you unpair it or clear the durable state. NemoClaw cannot detect cross-sandbox WhatsApp conflicts the way it does for token-based channels. Pair only one sandbox per WhatsApp account at a time. ## Enable Channels During Onboarding When the wizard reaches **Messaging channels**, it lists Telegram, Discord, Slack, and WhatsApp. Press a channel number to toggle it on or off, then press **Enter** when done. If a token is not already in the environment or credential store, the wizard prompts for it and saves it. WhatsApp uses QR pairing instead of a host-side token, so the wizard does not prompt. It prints pairing instructions and you complete the pairing inside the sandbox after rebuild. NemoClaw also selects the matching network policy preset during policy setup so the channel can reach its provider API. For scripted setup, export the credentials and optional settings for the channels you want to enable before you run onboarding: ```console $ export TELEGRAM_BOT_TOKEN= $ export TELEGRAM_REQUIRE_MENTION=1 $ export DISCORD_BOT_TOKEN= $ export DISCORD_SERVER_ID= $ export SLACK_BOT_TOKEN= $ export SLACK_APP_TOKEN= $ export SLACK_ALLOWED_USERS= ``` Then run onboarding: ```console $ nemoclaw onboard ``` Complete the rest of the wizard so the blueprint can create OpenShell providers where needed (for example `-telegram-bridge`), bake channel configuration into the image (`NEMOCLAW_MESSAGING_CHANNELS_B64`), and start the sandbox. ## Add Channels After Onboarding Run channel commands from the host, not from inside the sandbox. Use `channels list` to see the supported channel names: ```console $ nemoclaw my-assistant channels list ``` Add the channel you want: ```console $ nemoclaw my-assistant channels add telegram $ nemoclaw my-assistant channels add discord $ nemoclaw my-assistant channels add slack $ nemoclaw my-assistant channels add whatsapp ``` `channels add` collects whatever each channel needs (token prompts for Telegram, Discord, and Slack; a host-side QR scan for WeChat; nothing for WhatsApp because pairing happens in-sandbox after rebuild), registers bridge providers with the OpenShell gateway when tokens were captured, records the channel in the sandbox registry, and asks whether to rebuild immediately. The command accepts mixed-case input such as `Telegram`, then stores and prints the canonical lowercase channel name. If a matching built-in network policy preset exists, `channels add` applies it to the sandbox automatically before the rebuild so the bridge has egress to its upstream API; if applying the preset fails, NemoClaw warns and tells you to re-apply manually with `nemoclaw policy-add ` after the rebuild. Choose the rebuild so the running sandbox image picks up the new channel. If you need optional channel settings such as `TELEGRAM_ALLOWED_IDS`, `TELEGRAM_REQUIRE_MENTION`, `DISCORD_SERVER_ID`, `DISCORD_USER_ID`, or `DISCORD_REQUIRE_MENTION`, export them before the rebuild starts. If you defer the rebuild, apply the change later: ```console $ nemoclaw my-assistant rebuild ``` In non-interactive mode, set the required environment variables before running `channels add`. Missing credentials fail fast, and the command queues the change for a manual rebuild: ```console $ NEMOCLAW_NON_INTERACTIVE=1 TELEGRAM_BOT_TOKEN= \ nemoclaw my-assistant channels add telegram $ nemoclaw my-assistant rebuild ``` For Discord server access after onboarding, include the server settings when you add the channel and rebuild: ```console $ DISCORD_BOT_TOKEN= \ DISCORD_SERVER_ID= \ DISCORD_REQUIRE_MENTION=1 \ nemoclaw my-assistant channels add discord ``` ## Rotate or Remove Credentials Running `channels add` for a channel that is already configured overwrites the stored tokens and registers the updated bridge provider. Rebuild the sandbox after the update so the image reflects the current channel set. To remove a channel and clear its stored credentials, run: ```console $ nemoclaw my-assistant channels remove telegram ``` Use `channels stop` when you want to pause a bridge without deleting credentials: ```console $ nemoclaw my-assistant channels stop telegram $ nemoclaw my-assistant channels start telegram ``` Telegram, Discord, and Slack each allow only one active consumer per channel credential. Multiple sandboxes can use the same channel type at the same time when each sandbox uses a distinct bot/app token. For example, two Telegram sandboxes can DM the same `TELEGRAM_ALLOWED_IDS` account as long as they use different `TELEGRAM_BOT_TOKEN` values. If you enable a messaging channel and another sandbox already uses the same token, onboarding prompts you to confirm before continuing in interactive mode and exits non-zero in non-interactive mode. If NemoClaw only has legacy channel metadata and cannot compare credential hashes, it keeps the conservative warning; re-run `channels add ` with the intended token to refresh the stored non-secret hash. `nemoclaw status` reports cross-sandbox overlaps so you can resolve duplicates before messages start dropping. ## Stop Messaging Delivery Use `channels stop` when you want to pause one bridge and keep the sandbox running. Use `nemoclaw tunnel stop` or its deprecated alias `nemoclaw stop` when you want to stop host auxiliary services and also ask NemoClaw to stop the OpenClaw gateway inside the selected sandbox. Stopping the in-sandbox gateway stops Telegram, Discord, Slack, and WhatsApp polling for that sandbox until you restart the sandbox or gateway. ## Confirm Delivery After the sandbox is running, send a message to the configured bot or app. If delivery fails, use `openshell term` on the host, check gateway logs, and verify network policy allows the channel API. Use the matching policy preset (`telegram`, `discord`, `slack`, `wechat`, or `whatsapp`) or review [Common Integration Policy Examples](/network-policy/integration-policy-examples). ## Tunnel Command When the host has `cloudflared`, `nemoclaw tunnel start` starts a cloudflared tunnel that can expose the dashboard with a public URL. `nemoclaw tunnel stop` stops the tunnel and asks NemoClaw to stop the in-sandbox gateway for the selected or default sandbox. The older `nemoclaw start` still works as a deprecated alias. ```console $ nemoclaw tunnel start ``` ## Related Topics * [Deploy NemoClaw to a Remote GPU Instance](/deployment/deploy-to-remote-gpu) for remote deployment with messaging. * [Architecture](/reference/architecture) for how providers, the gateway, and the sandbox fit together. * [Commands](/reference/commands) for `channels add`, `channels remove`, `channels start`, `channels stop`, `tunnel start`, `tunnel stop`, and `status`.