Nostr

Status: Optional bundled plugin (disabled by default until configured).

Nostr is a decentralized protocol for social networking. This channel enables OpenClaw to receive and respond to encrypted direct messages (DMs) via NIP-04.

Bundled plugin

Current OpenClaw releases ship Nostr as a bundled plugin, so normal packaged builds do not need a separate install.

Older/custom installs

• Onboarding (
  text

  Copy

  openclaw onboard
  ) and
  text

  Copy

  openclaw channels add
  still surface Nostr from the shared channel catalog.
• If your build excludes bundled Nostr, install a current npm package when one is published.

bash
Copy
openclaw plugins install @openclaw/nostr

If npm reports the OpenClaw-owned package as deprecated, use a current packaged OpenClaw build or a local checkout until a newer npm package is published.

Use a local checkout (dev workflows):

bash
Copy
openclaw plugins install --link <path-to-local-nostr-plugin>

Restart the Gateway after installing or enabling plugins.

Non-interactive setup

bash
Copy
openclaw channels add --channel nostr --private-key "$NOSTR_PRIVATE_KEY"
openclaw channels add --channel nostr --private-key "$NOSTR_PRIVATE_KEY" --relay-urls "wss://relay.damus.io,wss://relay.primal.net"

Use

to keep in the environment instead of storing the key in config.

Quick setup

1. Generate a Nostr keypair (if needed):

bash
Copy
# Using nak
nak key generate

2. Add to config:

json5
Copy
{
  channels: {
    nostr: {
      privateKey: "${NOSTR_PRIVATE_KEY}",
    },
  },
}

3. Export the key:

bash
Copy
export NOSTR_PRIVATE_KEY="nsec1..."

4. Restart the Gateway.

Configuration reference

Profile metadata

Profile data is published as a NIP-01

event. You can manage it from the Control UI (Channels -> Nostr -> Profile) or set it directly in config.

Example:

json5
Copy
{
  channels: {
    nostr: {
      privateKey: "${NOSTR_PRIVATE_KEY}",
      profile: {
        name: "openclaw",
        displayName: "OpenClaw",
        about: "Personal assistant DM bot",
        picture: "https://example.com/avatar.png",
        banner: "https://example.com/banner.png",
        website: "https://example.com",
        nip05: "openclaw@example.com",
        lud16: "openclaw@example.com",
      },
    },
  },
}

Notes:

• Profile URLs must use
  text

  Copy

  https://
  .
• Importing from relays merges fields and preserves local overrides.

Access control

DM policies

• pairing (default): unknown senders get a pairing code.
• allowlist: only pubkeys in
  text

  Copy

  allowFrom
  can DM.
• open: public inbound DMs (requires
  text

  Copy

  allowFrom: ["*"]
  ).
• disabled: ignore inbound DMs.

Enforcement notes:

• Inbound event signatures are verified before sender policy and NIP-04 decryption, so forged events are rejected early.
• Pairing replies are sent without processing the original DM body.
• Inbound DMs are rate-limited and oversized payloads are dropped before decrypt.

Allowlist example

json5
Copy
{
  channels: {
    nostr: {
      privateKey: "${NOSTR_PRIVATE_KEY}",
      dmPolicy: "allowlist",
      allowFrom: ["npub1abc...", "npub1xyz..."],
    },
  },
}

Key formats

Accepted formats:

• Private key:
  text

  Copy

  nsec...
  or 64-char hex
• Pubkeys (
  text

  Copy

  allowFrom
  ):
  text

  Copy

  npub...
  or hex

Relays

Defaults:

and .

json5
Copy
{
  channels: {
    nostr: {
      privateKey: "${NOSTR_PRIVATE_KEY}",
      relays: ["wss://relay.damus.io", "wss://relay.primal.net", "wss://nostr.wine"],
    },
  },
}

Tips:

• Use 2-3 relays for redundancy.
• Avoid too many relays (latency, duplication).
• Paid relays can improve reliability.
• Local relays are fine for testing (
  text

  Copy

  ws://localhost:7777
  ).

Protocol support

Testing

Local relay

bash
Copy
# Start strfry
docker run -p 7777:7777 ghcr.io/hoytech/strfry

json5
Copy
{
  channels: {
    nostr: {
      privateKey: "${NOSTR_PRIVATE_KEY}",
      relays: ["ws://localhost:7777"],
    },
  },
}

Manual test

1. Note the bot pubkey (npub) from logs.
2. Open a Nostr client (Damus, Amethyst, etc.).
3. DM the bot pubkey.
4. Verify the response.

Troubleshooting

Not receiving messages

• Verify the private key is valid.
• Ensure relay URLs are reachable and use
  text

  Copy

  wss://
  (or
  text

  Copy

  ws://
  for local).
• Confirm
  text

  Copy

  enabled
  is not
  text

  Copy

  false
  .
• Check Gateway logs for relay connection errors.

Not sending responses

• Check relay accepts writes.
• Verify outbound connectivity.
• Watch for relay rate limits.

Duplicate responses

• Expected when using multiple relays.
• Messages are deduplicated by event ID; only the first delivery triggers a response.

Security

• Never commit private keys.
• Use environment variables for keys.
• Consider
  text

  Copy

  allowlist
  for production bots.
• Signatures are verified before sender policy, and sender policy is enforced before decrypt, so forged events are rejected early and unknown senders cannot force full crypto work.

Limitations (MVP)

• Direct messages only (no group chats).
• No media attachments.
• NIP-04 only (NIP-17 gift-wrap planned).

Related

• Channels Overview — all supported channels
• Pairing — DM authentication and pairing flow
• Groups — group chat behavior and mention gating
• Channel Routing — session routing for messages
• Security — access model and hardening