Openclaw Config

openclaw config list                   # All config paths and values

Common Configuration Tasks

Add a Telegram Channel

openclaw config set channels.telegram.enabled true
openclaw config set channels.telegram.botToken "$TELEGRAM_BOT_TOKEN"
openclaw config set channels.telegram.dmPolicy "open"
openclaw config set channels.telegram.groupPolicy "allowlist"
openclaw config set channels.telegram.requireMention true

Configure Multi-Agent Setup

# Add agents
openclaw config set agents.list '[{"id":"main","workspace":"~/.openclaw/agents/main"},{"id":"code","workspace":"~/.openclaw/agents/code"}]'

# Set bindings
openclaw config set bindings '[{"channel":"telegram","agentId":"main"},{"channel":"discord","agentId":"code"}]'

Add an MCP Server

openclaw config set agents.defaults.mcpServers '[{"name":"filesystem","command":"npx","args":["-y","@anthropic/mcp-fs","."],"transport":"stdio"}]'

Set Model with Fallbacks

openclaw config set agents.defaults.model.primary "anthropic/claude-opus-4-6"
openclaw config set agents.defaults.model.fallbacks '["anthropic/claude-sonnet-4-20250514","anthropic/claude-haiku-4-5-20251001"]'

Enable Sandbox

openclaw config set agents.defaults.sandbox.mode "non-main"
# or for maximum security:
openclaw config set agents.defaults.sandbox.mode "all"

Security Hardening

openclaw config set gateway.auth.token "${OPENCLAW_AUTH_TOKEN}"
openclaw config set agents.defaults.sandbox.mode "all"
openclaw config set agents.defaults.tools.profile "messaging"
openclaw config set agents.defaults.tools.deny '["browser","canvas","nodes","cron"]'

Workflow

1. First read current config: openclaw config get
2. Understand what the user wants to change
3. Make changes with openclaw config set
4. Verify changes: openclaw config get <path>
5. Restart Gateway if needed: openclaw gateway restart

Important Notes

• Config file is at ~/.openclaw/openclaw.json (JSON5 format)
• Gateway listens on port 18789 by default
• Changes to openclaw.json require a Gateway restart (use config.patch RPC to hot-reload)
• auth: none was removed in Feb 2026 — always configure authentication
• Review third-party skills carefully (ClawHavoc campaign found 800+ malicious skills)
• Use ${ENV_VAR} syntax for secrets in config files