openclaw - 💡(How to fix) Fix Personal WhatsApp dmPolicy default ("pairing") leaks pair codes to every contact [1 comments, 2 participants]

Summary

When OpenClaw is connected to a personal WhatsApp account (using the user's own phone number rather than a dedicated bot account), the default channels.whatsapp.dmPolicy: "pairing" causes the gateway to auto-respond to every unknown sender — i.e. every personal contact who is not on allowFrom — with a pair-code message, sent from the user's own WhatsApp number.

Reproduction

1. Set up OpenClaw with the personal WhatsApp channel (default config).
2. Have any contact (not on allowFrom) send a message to your number — even a single emoji like 👍.
3. OpenClaw replies from your account with:

   OpenClaw: access not configured.
   Your WhatsApp phone number: +<their number>
   Pairing code: <CODE>
   Ask the bot owner to approve with: openclaw pairing approve whatsapp <CODE>

Why this is a problem on personal WhatsApp

• Every existing contact who messages you = "unknown sender" → triggers an auto-reply they never asked for.
• Random/scam contacts (e.g. WhatsApp Business spam) also get a pair code — looks indistinguishable from a real social-engineering exchange and is confusing for the owner who sees it later in their chat.
• The pair code itself can't be used without owner approval, but the leaked phone number + pair-instruction text creates believable phishing material.
• It's invisible by default to the owner: replies are sent silently from their own account.

Suggested fix

For personal WhatsApp accounts (i.e. the channel is bound to the owner's own number, detectable via the connection identity), default dmPolicy to allowlist with allowFrom pre-populated to the owner's own number. Keep pairing as the default for dedicated bot accounts / business numbers where the multi-user pairing flow makes sense.

Alternatively, prompt the user during openclaw setup to choose between the two intents ("personal account — only me" vs. "shared bot — others can pair").

Workaround

Manually set: ```bash openclaw config set channels.whatsapp.dmPolicy allowlist openclaw config set channels.whatsapp.allowFrom '["+<your number>"]' --strict-json openclaw gateway restart ```

Version

• OpenClaw 2026.4.25 (aa36ee6) on macOS 26.4.1