OpenClaw Telegram Dashboard Mini App

The Dashboard Mini App puts the whole OpenClaw Control UI inside Telegram: a command in a DM, a button, and the dashboard opens as a Telegram WebApp. Because that dashboard is the most privileged surface OpenClaw has, the requirements around it are strict. Here is how it opens, what it needs, how the hand-off is verified, and where the v1 stops.

Opening the dashboard

• Run the dashboard command in a DM with the bot and tap the Open dashboard button; the command is registered automatically when the Telegram plugin is active, with no separate Mini App flag.
• It needs a published HTTPS Mini App URL, which means the gateway's Tailscale mode set to serve or funnel, and OpenClaw automatically honours the Control UI base path when building the Control UI and WebSocket URLs.
• Your numeric Telegram user ID must be in the selected account's effective allowlist or in the owner allowlist, since wildcards and usernames do not grant Mini App owner access, and the command only works in a DM: in a group it replies that you should open it in a DM with the bot and sends no button.
• Docker installs need the gateway to bind loopback next to the Tailscale daemon, which bridge networking with published ports cannot satisfy, so the gateway container runs with host networking and mounts the host's Tailscale socket and the Tailscale CLI into the container.

The Mini App is a Tailscale-only v1 path and does not support Telegram Web iframe.

The verified hand-off

When the Mini App opens, Telegram provides signed WebApp initData. OpenClaw verifies its signature with the selected bot account's token, rejects data that is missing, invalid, expired or replayed, extracts the numeric Telegram user ID, and checks owner access again before handing off to the Control UI, so the button is a convenience rather than a bypass of the owner rule.

When it cannot open

• If the dashboard command cannot resolve a published HTTPS URL it replies that the Mini App needs an HTTPS gateway URL and that you should set the Tailscale mode to serve or funnel and retry.
• The fix is to set one of those modes in the gateway block, make sure Tailscale is running on the gateway host, and run the command again.
• The Mini App is a Tailscale-only v1 path and does not support the Telegram Web iframe, so it is opened from a native Telegram client.

OpenClaw on Telegram is the channel post this Mini App belongs to, and OpenClaw Telegram rich messages and approvals the web-app button type that a Mini App launcher uses in other messages.

Why Tailscale and not a public URL

Publishing the Control UI over Tailscale serve or funnel keeps the dashboard behind an identity-aware network rather than an open HTTPS endpoint, and the signed initData check on top of it means even a leaked link opens nothing for anyone but the owner. OpenClaw remote access covers the remote-access model that publishing rests on, and OpenClaw Telegram access control the allowlists the owner check reads.

On Diali

On Diali the Telegram channel is connected from the dashboard and the runtime config is generated and replaced at each release; the hosted dashboard is the Diali one, so this Telegram Mini App describes the self-hosted route rather than a button you will see on a hosted agent. Telegram on Diali is the channel on Diali and Diali security the boundary every connected channel shares.

• One command in a DM; serve or funnel publishes the URL.
• Owner access by numeric ID only; wildcards do not count.
• Signed initData is verified, then the owner check runs again.