OpenClaw Feishu troubleshooting

Feishu failures split into the platform side, an app not published, an event not subscribed, a scope not granted, and the gateway side, a clock off by an hour or a stale secret. The docs list both as short checklists. Here they are in order: silent groups, no events at all, meeting auto-join, rejected webhooks, the QR flow, and a leaked secret.

Silent groups and missing events

• A bot that does not respond in group chats needs four checks: that the bot is added to the group, that you mention it, since a mention is required by default, that the group policy is not disabled, and the logs.
• A bot that receives no messages needs seven: the app published and approved in the Feishu Open Platform or Lark Developer console, the event subscription including the message-receive event, the meeting-invited event added for meeting auto-join, the persistent WebSocket connection selected, all required permission scopes granted, the gateway running per its status command, and the logs.
• Subscribing to the meeting-invited event only delivers the event; automatic joins are off by default and are enabled globally with the auto-join key or for one account by omitting the top-level switch and setting the account override.
• Inviters still pass through the normal DM policy, allowlist or pairing, session and reply routing before the agent receives a join turn, and joining also requires an available Feishu VC join tool configured for app identity with the meeting bot join scope, such as the official CLI's VC agent skill, which currently marks meeting-bot actions as a limited beta where a not-in-gray error or error code 20017 means the app or tenant has not been enabled for the beta and the early-access guidance applies before ordinary scope troubleshooting.

Automatic joins are default-off.

Rejected webhooks

A webhook callback rejected with a 401 invalid signature has four checks. First the gateway host clock, because webhook mode rejects signed callbacks whose timestamp is more than one hour from the server clock in either direction, so NTP sync and a correct system time come first. Then the configured encrypt key must match the app's Encrypt Key in the Feishu or Lark console. Then the webhook URL path and port must match the channel's webhook configuration. And finally the logs, followed for repeated signature failures from unexpected senders, which point to someone else calling the endpoint rather than to a configuration problem.

QR setup and a leaked secret

• When QR setup does not react in the Feishu mobile app, rerun the channel login command, choose manual setup, create a self-built app in the Feishu Open Platform, copy its App ID and App Secret, and paste them into the wizard.
• A leaked App Secret is rotated by resetting it in the Feishu or Lark console and updating the value in the config.
• Then verify that hot reload applied the new credentials with the status probe rather than assuming a restart is needed.

OpenClaw on Feishu is the channel post these symptoms belong to, and OpenClaw Feishu setup the wizard and delivery window most of them trace back to.

Clock before key

The order of the signature checks is deliberate: a host clock an hour out rejects every fresh callback before the key is even compared, so it is the first thing to rule out and the one no config change can fix. OpenClaw Feishu access control covers the policies behind a silent group, and OpenClaw Slack troubleshooting the symptom-first list for Slack.

On Diali

Feishu and Lark are not among the channels Diali connects today: WhatsApp, Telegram, Discord, Slack, Mattermost, Matrix, SMS and voice. Hosted OpenClaw on Diali is the assistant and Diali security describes the boundary that applies to each connected channel.

• Silent group: added, mentioned, policy not disabled, logs.
• A 401 means the clock, the key, or the path, in that order.
• Rotate a leaked secret, then probe; hot reload applies it.