Feishu Bot Access Control: DM Policy, Group Policy, and IDs

This page covers who is allowed to interact with the Feishu bot, gives group configuration examples that put those rules into practice, and explains where to find the IDs required for them.

Access control

Direct messages

The channels.feishu.dmPolicy setting (default: pairing) decides who may DM the bot:

To approve a pairing request:

openclaw pairing list feishu
openclaw pairing approve feishu <CODE>

Group chats

Group policy (channels.feishu.groupPolicy, default: allowlist):

Mention requirement (channels.feishu.requireMention):

• By default an @mention is required. The exception is when the effective group policy is "open": there the default becomes false, so messages that cannot carry a mention (images, for instance) are still delivered to the agent.
• To override, set true or false explicitly; a single group can be overridden with channels.feishu.groups.<chat_id>.requireMention.
• Mentions that only broadcast, namely @all and @_all, do not count as mentioning the bot. A message that mentions @all and the bot directly is still treated as a bot mention.

Mentions of other people remain readable in the text handed to the agent, even when several consecutive messages are merged.

Mentions in bot-started threads

With requireMentionInBotThreads: false set, messages are accepted without an @mention in threads or topics whose root message this bot sent. Setting it to true makes an @mention mandatory in those threads, even when requireMention is false. Leaving the setting out keeps the mention behavior you already have.

{
  channels: {
    feishu: {
      requireMention: true,
      requireMentionInBotThreads: false,
    },
  },
}

You can configure this setting at channels.feishu, under accounts.<id>, or under groups.<chat_id>. Precedence runs from the selected group entry, then the account setting, then the top-level setting. When no exact group entry exists, groups["*"] supplies the group entry by matching requireMention.

Only genuine threads and topics owned by the current bot are affected. Ordinary quoted replies, threads another person started, and roots that cannot be read or verified fall back to the regular mention policy. Group access, sender allowlists, and bot-message restrictions continue to apply. Unmentioned group messages also require the app's im:message.group_msg scope plus group message event delivery; which events Feishu sends is not changed by this setting.

Group configuration examples

Allow all groups, no @mention required

{
  channels: {
    feishu: {
      groupPolicy: "open", // requireMention defaults to false under "open"
    },
  },
}

Allow all groups, still require @mention

{
  channels: {
    feishu: {
      groupPolicy: "open",
      requireMention: true,
    },
  },
}

Allow specific groups only

{
  channels: {
    feishu: {
      groupPolicy: "allowlist",
      // Group IDs look like: oc_xxx
      groupAllowFrom: ["oc_xxx", "oc_yyy"],
    },
  },
}

Under allowlist mode, a group can also be admitted by adding an explicit groups.<chat_id> entry. Such explicit entries cannot override groupPolicy: "disabled". Wildcard defaults under groups.* configure the groups they match, yet on their own they do not admit any group.

{
  channels: {
    feishu: {
      groupPolicy: "allowlist",
      groups: {
        oc_xxx: {
          requireMention: false,
        },
      },
    },
  },
}

Restrict senders within a group

{
  channels: {
    feishu: {
      groupPolicy: "allowlist",
      groupAllowFrom: ["oc_xxx"],
      groups: {
        oc_xxx: {
          // User open_ids look like: ou_xxx
          allowFrom: ["ou_user1", "ou_user2"],
        },
      },
    },
  },
}

channels.feishu.groupSenderAllowFrom applies one sender allowlist to every group; a per-group allowFrom wins over it.

Bot-authored messages

By default, Feishu discards any message written by another bot. If you want bots to talk to each other inside a group, give the app the im:message.group_at_msg.include_bot:readonly and im:message:readonly scopes and then configure allowBots:

{
  channels: {
    feishu: {
      allowBots: true,
    },
  },
}

A bot-authored group event reaches Feishu only when some other bot @mentions this bot. The usual group policy, sender allowlists, and mention rules still apply. OpenClaw discards messages it wrote itself, @mentions the peer bot in every text or card reply, and enforces the shared channels.defaults.botLoopProtection guard.

Get group/user IDs

Group IDs (chat_id, format: oc_xxx)

In Feishu/Lark, open the group, click the menu icon at the top right, and choose Settings. The settings page shows the group ID (chat_id).

User IDs (open_id, format: ou_xxx)

Launch the gateway, DM the bot, and then inspect the logs:

openclaw logs --follow

Search the log output for open_id. Pending pairing requests can be checked as well:

openclaw pairing list feishu