The Gateway and Its Channels

Connect Telegram, WhatsApp and Slack, and you might expect three programs running. OpenClaw runs one. Knowing what that one process does explains most of how OpenClaw behaves, and most of how to keep it safe.

The rule

One Gateway holds every channel; everything else is a client.

The Gateway is a single process that is meant to run for a long time without stopping. It has three jobs:

• It holds every channel. The connections to Telegram, WhatsApp, Discord, Slack, Signal, iMessage and the rest all live inside this one process, at the same time. No separate program per app.
• It routes. Each incoming message goes to the right agent, and the agent's reply goes back out through the channel it came from.
• It serves the control plane. Management tools, such as the openclaw command-line tool, the macOS app and the web-based Control UI, are clients. They connect to the Gateway through a typed WebSocket API to inspect and manage it.

All of this shares one port. The WebSocket control and RPC interface, the HTTP APIs, the Control UI and hooks are multiplexed on it. Two safe defaults protect that port: the Gateway binds to localhost, so only programs on the same machine can reach it, and it requires an auth token before accepting any connection.

Channels are equal for text but not for extras. Plain text messages work everywhere. Reactions, media, editing a sent message and group-chat behaviour depend on what each platform's own API offers, so a feature you enjoy in Discord may simply not exist in Signal.

The shortcut

Whenever something happens, ask "Which side of the Gateway is this on?" Outside: the channels, where messages come from. Inside: the agents that do the work. Beside: the clients that manage the Gateway.

The trap is forgetting that "one process" also means one point of failure. If the Gateway stops, every channel goes quiet at once.

Drills

Answer fast — trust the rule.

Remember

• One Gateway holds every channel; the CLI, the app and the Control UI are clients.
• Ask "outside, inside or beside?" to place anything that happens.
• One port, localhost and a token by default; and if the Gateway stops, every channel stops.