Google Chat

Status: Available for DMs and spaces. Integrated via Google Chat API webhooks (HTTP only).

1. Create a Google Cloud project and enable Google Chat API:

- Open: ''Google Chat API Credentials''

- If not yet enabled, enable the API first.

2. Create a Service Account:

- Click Create Credentials > Service Account.

- Name it anything (e.g., openclaw-chat).

- Leave permissions empty (click Continue).

- Leave accessible principals empty (click Done).

3. Create and download JSON Key:

- In the service accounts list, click the account you just created.

- Open the Keys tab.

- Click Add Key > Create new key.

- Select JSON and click Create.

4. Save the downloaded JSON file to the gateway host (e.g., ~/.openclaw/googlechat-service-account.json).

5. Create a Google Chat app in ''Google Cloud Console Chat Configuration'':

- Fill in Application info:

- App name: (e.g., OpenClaw)

- Avatar URL: (e.g., https://openclaw.ai/logo.png)

- Description: (e.g., Personal AI Assistant)

- Enable Interactive features.

- In Functionality, check Join spaces and group conversations.

- In Connection settings, select HTTP endpoint URL.

- In Triggers, select Use a common HTTP endpoint URL for all triggers, and set it to your gateway public URL + /googlechat.

- Tip: Run openclaw status to see your gateway public URL (if configured).

- In Visibility, check Make this Chat app available to specific people and groups in <Your Domain>.

- Enter your email in the text box (e.g., [email protected]).

- Click Save at the bottom of the page.

6. Enable App status:

- Refresh the page after saving.

- Find App status (usually appears at the top or bottom of the page after saving).

- Change the status to Live - available to users.

- Click Save again.

7. Configure the service account path and webhook audience in OpenClaw:

- Env: GOOGLE_CHAT_SERVICE_ACCOUNT_FILE=/path/to/service-account.json

- Or config: channels.googlechat.serviceAccountFile: "/path/to/service-account.json";.

8. Set the webhook audience type and value (must match your Chat app configuration).

9. Start the gateway. Google Chat will send POST requests to your webhook path.

When the gateway is running and your email is in the visibility list:

1. Open ''Google Chat''.

2. Click + next to Direct Messages.

3. Enter the App name you configured in Google Cloud Console in the search box.

- Note: This is a private app and won't appear in the "Marketplace" browse list; you can only find it by name.

4. Select your bot from the results.

5. Click Add or Chat to start a 1:1 conversation.

6. Send "Hello" to test the trigger.

Google Chat webhooks require a publicly accessible HTTPS endpoint. For security, only expose the /googlechat path to the public internet. Keep the OpenClaw dashboard and other sensitive endpoints on a private network.

#

Use Tailscale Serve to host a private dashboard, and Funnel to only expose the webhook path. This keeps / private and only exposes /googlechat to the public internet.

1. Check the gateway bound address:

`bash

ss -tlnp | grep 18789

`

Record the IP (e.g., 127.0.0.1, 0.0.0.0, or Tailscale IP: 100.x.x.x).

2. Expose dashboard to tailnet only (port 8443):

`bash

# Bind to localhost (127.0.0.1 or 0.0.0.0):

tailscale serve --bg --https 8443 http://127.0.0.1:18789

# Bind only to Tailscale IP (e.g., 100.106.161.80):

tailscale serve --bg --https 8443 http://100.106.161.80:18789

`

3. Expose only webhook path to public internet:

`bash

# Bind to localhost (127.0.0.1 or 0.0.0.0):

tailscale funnel --bg --set-path /googlechat http://127.0.0.1:18789/googlechat

# Bind only to Tailscale IP (e.g., 100.106.161.80):

tailscale funnel --bg --set-path /googlechat http://100.106.161.80:18789/googlechat

`

4. Authorize Funnel for this node:

If the command prompts for authorization, visit the authorization URL in the output to allow this node to use Funnel in the tailnet policy.

`bash

tailscale serve status

tailscale funnel status

`

Public webhook URL:

https://<node-name>.<tailnet>.ts.net/googlechat

Private dashboard (tailnet only):

https://<node-name>.<tailnet>.ts.net:8443/

Use the public URL in your Google Chat app configuration (without :8443).

#

Proxy only specific paths:

your-domain.com {
    reverse_proxy /googlechat* localhost:18789
}

This way your-domain.com/ is ignored or returns 404, while your-domain.com/googlechat is securely forwarded to OpenClaw.

#

Set the tunnel's ingress rules to only route the webhook path:

- Path: /googlechat -> http://localhost:18789/googlechat

- Default Rule: HTTP 404 (Not Found)

1. Google Chat sends a webhook POST to the gateway. Each request includes Authorization: Bearer <token>.

2. OpenClaw validates the token according to the configured audienceType + audience:

- audienceType: "app-url": audience is your HTTPS webhook URL.

- audienceType: "project-number": audience is the Cloud project number.

3. Messages are routed by space:

- DMs use session key ''agent:'':googlechat:dm:''''.

- Spaces use session key ''agent:'':googlechat:group:''''.

4. DMs default to pairing: unknown senders receive a pairing code; approve with:

- ''openclaw pairing approve googlechat ''''

5. Group spaces require @mention to reply by default. If mention detection requires the app's username, configure botUser.

Identifiers for delivery and allowlists:

- DMs: ''users/'''' or ''users/'''' (email supported)

- Spaces: ''spaces/''''

{
  channels: {
    googlechat: {
      enabled: true,
      serviceAccountFile: "/path/to/service-account.json",
      audienceType: "app-url",
      audience: "https://gateway.example.com/googlechat",
      webhookPath: "/googlechat",
      botUser: "users/1234567890",
      dm: {
        policy: "pairing",
        allowFrom: ["users/1234567890", "[email protected]"],
      },
      groupPolicy: "allowlist",
      groups: {
        "spaces/AAAA": {
          allow: true,
          requireMention: true,
          users: ["users/1234567890"],
          systemPrompt: "Short answers only.",
        },
      },
      actions: { reactions: true },
      typingIndicator: "message",
      mediaMaxMb: 20,
    },
  },
}

Explanation:

- Service account credentials can also be provided inline as a JSON string via serviceAccount.

- When webhookPath is not set, defaults to /googlechat.

- When actions.reactions is enabled, reactions can be used via the reactions tool and channels action.

- typingIndicator supports none, message (default), reaction (reaction requires user OAuth).

- Attachments are downloaded via the Chat API and go through the media pipeline (size limited by mediaMaxMb).

#

If Google Cloud Logs Explorer shows an error like:

status code: 405, reason phrase: HTTP error response: HTTP/1.1 405 Method Not Allowed

This usually means the webhook handler is not registered. Common causes:

1. Channel not configured: channels.googlechat is missing from the config. Verify:

__CODE_BLOCK_1__bash

openclaw channels status

`

#

- Run openclaw channels status --probe to check for authentication errors or missing audience configuration.

- If no messages arrive, verify the Chat app's webhook URL and event subscriptions.

- If mention gating blocks replies, set botUser to the app's user resource name and check requireMention.

- Run openclaw logs --follow when sending test messages to confirm requests reach the gateway.

Related documentation:

- ''Gateway configuration''

- ''Security''

- ''Reactions''