# Admit one Telegram sender to hosted OpenClaw Add the bot token and intended Telegram user ID in xCloud, then confirm the named sender can chat while access remains bounded. Canonical: https://xcloud.host/use-cases/playbooks/openclaw-telegram-approved-sender/ Published: 2026-10-01 · Updated: 2026-10-01 · Technical review: 2026-10-01 Evidence: Source reviewed; no production deployment test claimed Editorial owner: xCloud editorial Intent: Connect a Telegram bot to hosted OpenClaw and verify the approved sender For: operations-owner ## Requirements and responsibilities - Create or control a Telegram bot and identify the exact Telegram user ID for the approved sender. The xCloud deployment guide documents these two inputs and says the ID is auto-paired. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw chat channels](https://docs.openclaw.ai/channels); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) - Ensure the first private OpenClaw chat already works so channel troubleshooting does not conceal a provider failure. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw chat channels](https://docs.openclaw.ai/channels); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ## Illustrative situation Illustrative scenario: one team lead wants to message a newly hosted assistant from a personal Telegram account; other senders have not been approved. ## Choose the approach - Use the xCloud Channels form for Telegram token and user ID. The deployment guide lists Telegram as the built-in hosted channel; do not infer that other upstream channels are available in this template. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw chat channels](https://docs.openclaw.ai/channels); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ## Dashboard and application procedure ### 1. Match the bot and sender **Where:** Telegram and xCloud Channels **Permissions:** Authorized OpenClaw owner or application administrator **Inputs:** Bot identity, bot token and approved Telegram numeric user ID **Action:** Confirm the bot is controlled by the intended owner and the user ID belongs to the approved sender. Keep the token in the xCloud form, not a message. **Expected result:** A single bot and sender identity are documented. **Verify:** Have the sender read back the bot handle and their own ID through a trusted route. **If it fails:** If identity is uncertain, stop before changing channel settings. Capability: Inspect and manage the hosted OpenClaw service Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ### 2. Save the hosted channel **Where:** xCloud OpenClaw → Channels **Permissions:** Authorized OpenClaw owner or application administrator **Inputs:** Telegram bot token and approved user ID **Action:** Enter or update both documented fields and save changes. Preserve the previous channel values securely for rollback. **Expected result:** The dashboard accepts the channel configuration. **Verify:** Reopen Channels and confirm the intended bot and user ID are reflected without exposing the token. **If it fails:** If the form rejects either value, keep the previous channel configuration and resolve token or ID ownership before retrying. Capability: Inspect and manage the hosted OpenClaw service Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/) ### 3. Test the approved sender **Where:** Telegram direct message **Permissions:** Authorized OpenClaw owner or application administrator **Inputs:** Approved account and a harmless nonce **Action:** From the approved account, send a unique short request for the assistant to repeat the nonce. **Expected result:** The correct nonce returns to the approved conversation. **Verify:** Compare the account, bot handle, nonce and response time. **If it fails:** If there is no reply, inspect OpenClaw Status and Logs and recheck the token and ID before re-pairing. Capability: Configure an OpenClaw application behavior Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw chat channels](https://docs.openclaw.ai/channels) ### 4. Check the sender boundary **Where:** Separate unapproved Telegram account **Permissions:** Authorized OpenClaw owner or application administrator **Inputs:** A consenting test account with no approved ID **Action:** Send the same harmless request from the unapproved account; inspect whether the bot denies, ignores or queues pairing. Do not approve the test account. **Expected result:** No agent answer or tool action is granted to the unapproved account. **Verify:** Compare both conversations and inspect logs for unintended acceptance. **If it fails:** If the unapproved sender receives an agent response, disable the channel and review OpenClaw access policy before use. Capability: Configure an OpenClaw application behavior Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control); [OpenClaw chat channels](https://docs.openclaw.ai/channels) ### 5. Record ownership and rotation **Where:** Operator runbook and xCloud Channels **Permissions:** Authorized OpenClaw owner or application administrator **Inputs:** Bot owner, approved user ID, support contact **Action:** Record who may update the token or user ID and the positive/negative test outcomes. Define a token-rotation check using the same nonce tests. **Expected result:** An owner can repeat access checks after changes. **Verify:** Have the owner locate the Channels control and identify both test accounts. **If it fails:** If the channel has no owner or failed denied-sender test, keep it disabled. Capability: Inspect and manage the hosted OpenClaw service Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ## Maintenance - After bot-token or user-ID changes, repeat a nonce from the approved Telegram account and a denied-sender test from the separate test account. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ## Recovery decisions - If the approved account fails, recheck token, user ID, Status and Logs. If an unapproved account receives a reply, disable the channel and restore the last known approved access policy before re-testing. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ## AI handoff Use the named xCloud dashboard for hosted controls and verify application tools in the deployed OpenClaw version before use. An xCloud hosting MCP write operation for these actions is not documented. ### Supported scope - **Inspect and manage the hosted OpenClaw service** (dashboard; manual): Use only controls visible for this managed OpenClaw server. Creation, provider, channel, UI, updates and logs are separate xCloud dashboard actions; no OpenClaw hosting MCP write operation is documented. Checkpoint: Confirm the exact server, selected control and effect before changing it; inspect resulting status and a bounded chat. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/) - **Configure an OpenClaw application behavior** (app; manual): Upstream OpenClaw documentation describes application features. xCloud does not document every app configuration surface or pre-enabled tool. Verify the feature and permissions in the deployed build before editing. Checkpoint: Use a harmless positive and negative test; preserve current configuration and stop if the feature is unavailable. Sources: [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/); [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) ### Copyable agent brief ```text In this Telegram DM, repeat the nonce [nonce] exactly once and perform no tool action. An unapproved test account must not receive an agent answer. ``` ### Manual checkpoints - The bot owner enters the token and numeric approved user ID in xCloud Channels. - The owner independently checks both Telegram accounts and disables the channel if the denied-sender test fails. ## Feature coverage - **task setup and decision** (covered): Defines prerequisites and an explicit hosted/application handoff. Steps: identity, channel - **task acceptance and failure** (covered): The approved Telegram ID receives the nonce response and the unapproved test account cannot make the agent answer or act. Failure: A mismatched bot/ID, no positive reply or an unauthorized reply blocks rollout. Steps: positive, negative, handover ## Sources - [How to Deploy OpenClaw with xCloud](https://xcloud.host/docs/how-to-deploy-openclaw-with-xcloud/) — reviewed 2026-10-01 - [OpenClaw chat channels](https://docs.openclaw.ai/channels) — reviewed 2026-10-01 - [OpenClaw security and access control](https://docs.openclaw.ai/help/faq/security-and-access-control) — reviewed 2026-10-01 ## Continue [OpenClaw hosting details](https://xcloud.host/openclaw-hosting/) - [Verify a private first task on managed OpenClaw](https://xcloud.host/use-cases/playbooks/openclaw-private-first-run/) - [Restrict access to the OpenClaw Control UI](https://xcloud.host/use-cases/playbooks/openclaw-control-ui-private-access/)