How to Set Up an OpenClaw Discord Bot: Complete Guide 2026

A complete, step-by-step guide to creating a Discord bot powered by OpenClaw. From the Discord Developer Portal to a fully configured AI agent in your server, plus the security steps you should not skip.

Discord is not just for gamers anymore. With over 200 million monthly active users, Discord has become the default communication layer for developer communities, open-source projects, crypto DAOs, SaaS support channels, and small businesses. If your audience lives on Discord, your AI agent should too.

OpenClaw's Discord plugin connects your AI agent directly to your Discord server. It can respond to messages, handle slash commands, participate in channel conversations, and operate 24/7 without you having to be online. The problem is that setting it up correctly requires navigating Discord's Developer Portal, understanding gateway intents, configuring OAuth2 permissions, and handling security details that most tutorials gloss over.

This guide covers the entire process: creating a Discord application, configuring bot permissions, connecting it to OpenClaw, securing your bot token, and troubleshooting the issues that trip people up most often. Whether you are self-hosting OpenClaw or using a managed platform, this guide applies.

Why Discord for AI Agents

Before diving into the setup, it is worth understanding why Discord is one of the best channels for AI agent deployment. Different messaging platforms serve different audiences, and choosing the right one matters.

Developer and Open-Source Communities

Discord is the home of developer communities. Projects like Midjourney, Vercel, and hundreds of open-source tools run their community support through Discord servers. If you are building a developer tool, a technical product, or an open-source project, your users are already on Discord. An AI agent in your Discord server can answer technical questions, triage issues, point users to documentation, and handle repetitive support queries without burning out your maintainers.

Gaming and Creator Communities

Gaming communities were Discord's original audience, and they remain one of the largest user segments. AI agents in gaming servers can handle moderation, answer questions about game mechanics, manage event scheduling, and provide automated onboarding for new members. Creator communities (YouTubers, streamers, artists) use AI agents to manage fan engagement, handle merch inquiries, and automate community management tasks.

Business and Support Communities

An increasing number of SaaS companies, agencies, and small businesses use Discord as their primary customer-facing channel. It is free, real-time, supports rich media, and scales from 10 users to 100,000+. An AI agent on Discord can serve as a first-line support representative: answering FAQs, routing complex issues to the right team member, and handling after-hours inquiries when no one is online.

Always-On Availability

Unlike email or ticketing systems, Discord is synchronous. Users expect near-instant responses. An AI agent running 24/7 meets this expectation without requiring human staff around the clock. For global communities spanning multiple time zones, this is a significant advantage over staffed support channels.

Step 1: Create a Discord Application

Every Discord bot starts as a Discord Application in the Developer Portal. The application is a container that holds your bot's identity, permissions, and credentials.

1. Go to the Discord Developer Portal and log in with your Discord account
2. Click New Application in the top-right corner
3. Give your application a name. This will be the display name of your bot in Discord servers. Choose something professional and recognizable (e.g., "Acme Support Bot" or "DevHelper AI")
4. Accept the Discord Developer Terms of Service and click Create

You will land on the application's General Information page. Here you can customize your bot's avatar, description, and tags. Take a moment to upload a professional avatar and write a clear description. Users will see this information when they inspect the bot in your server.

Note down the Application ID from this page. You will need it later when generating the bot invite URL.

Step 2: Create the Bot User and Get Your Token

The application you created is not a bot yet. You need to explicitly add a bot user to it.

1. In the left sidebar, click Bot
2. Click Add Bot and confirm when prompted
3. Under the bot's username, click Reset Token to generate a new bot token
4. Copy the token immediately and store it securely

Critical security note: Your bot token is equivalent to a password. Anyone who has it can control your bot, read messages it has access to, and send messages on its behalf. Store it in a password manager or secrets vault. Never commit it to version control. Never paste it in a public channel. If you suspect your token has been leaked, reset it immediately from this page.

The token looks something like this (this is not a real token):

MTIzNDU2Nzg5MDEyMzQ1Njc4.GaBcDe.AbCdEfGhIjKlMnOpQrStUvWxYz1234567890

The three parts separated by dots encode: the bot's user ID (base64), a timestamp, and an HMAC signature. If any part is missing or malformed, the token will not authenticate.

Step 3: Configure Privileged Gateway Intents

Discord uses a system called Gateway Intents to control what data your bot can receive. Some intents are "privileged" and must be explicitly enabled in the Developer Portal before your bot can use them.

Still on the Bot page, scroll down to the Privileged Gateway Intents section and enable these three toggles:

• Presence Intent - Allows the bot to see which users are online, idle, or offline. Optional for most use cases, but useful if your agent needs to know whether a user is currently active.
• Server Members Intent - Allows the bot to receive events when members join, leave, or update their profiles. Required if your bot needs to greet new members or track membership changes.
• Message Content Intent - Required. Without this intent, your bot cannot read the text content of messages. It will still receive message events, but the content field will be empty. This is the most commonly missed step in Discord bot setup.

The 100-Server Verification Threshold

Here is something most tutorials do not mention: once your bot is in 75 or more servers, Discord requires you to go through a bot verification process before you can continue using privileged intents. This is Discord's way of ensuring that bots accessing sensitive data (message content, member lists) are legitimate and well-maintained.

The verification process requires:

• A valid government-issued ID from the bot owner
• A description of what the bot does and why it needs privileged intents
• Compliance with Discord's Terms of Service and Developer Policy
• Approval from Discord's team (can take several days to weeks)

If your bot will serve a single community or a handful of servers, this does not apply. But if you plan to distribute it broadly, plan for the verification process early. Your bot will stop working once it hits the threshold if the verification is not already approved.

Step 4: Configure OAuth2 Permissions

Before you can invite your bot to a server, you need to define what permissions it will have. Discord uses OAuth2 for bot authorization, and the permissions you select here determine what the bot can and cannot do once it joins a server.

1. In the left sidebar, click OAuth2
2. Then click URL Generator
3. Under Scopes, check bot and applications.commands

The bot scope adds the bot user to the server. The applications.commands scope allows the bot to register slash commands (like /help or /ask).

Selecting Bot Permissions

Under Bot Permissions, select the following for a typical AI agent deployment:

• Read Messages/View Channels - See channels and read messages the bot has access to
• Send Messages - Post responses in channels
• Send Messages in Threads - Respond within thread conversations
• Embed Links - Include rich embeds in messages (useful for formatted responses)
• Attach Files - Upload files (screenshots, generated documents, etc.)
• Read Message History - Access previous messages in a channel for context
• Add Reactions - React to messages (useful for acknowledgment or feedback)
• Use Slash Commands - Respond to slash command interactions

The Principle of Least Privilege

Only grant permissions your bot actually needs. If your AI agent does not need to manage channels, kick members, or manage roles, do not enable those permissions. Every unnecessary permission expands the blast radius if the bot is compromised or misbehaves.

Avoid granting Administrator permission. It overrides all other permission checks and gives the bot full control of the server. There is almost never a legitimate reason for an AI agent to need administrator access.

After selecting permissions, Discord generates an invite URL at the bottom of the page. Copy this URL. You will use it in the next step.

Step 5: Invite the Bot to Your Server

1. Open the invite URL you copied from the OAuth2 URL Generator in your browser
2. Select the server you want to add the bot to from the dropdown. You must have the Manage Server permission in the target server
3. Review the permissions the bot is requesting and click Authorize
4. Complete the CAPTCHA if prompted

Your bot should now appear in the server's member list with an "APP" badge. It will show as offline until the OpenClaw connection is established.

If you want to restrict the bot to specific channels (recommended), you can adjust its permissions using Discord's role system after it joins. Create a dedicated bot role, assign it to the bot, and then configure channel-level permissions to control where the bot can read and respond.

Step 6: Configure OpenClaw's Discord Plugin

With the bot created and invited to your server, it is time to connect it to OpenClaw. If you have not yet installed OpenClaw, see our complete OpenClaw installation guide first.

Add the Bot Token to Your Environment

Add the Discord bot token to your .env file on the server where OpenClaw is running:

DISCORD_BOT_TOKEN=your_discord_bot_token_here

Do not put the token directly in your OpenClaw YAML configuration file. Environment variables are the correct place for secrets. The .env file should have restrictive file permissions (chmod 600) and should never be committed to version control.

Enable the Discord Plugin in openclaw.yaml

Open your openclaw.yaml configuration file and add the Discord channel configuration:

channels:
  discord:
    enabled: true
    dmPolicy: "pairing"     # Require approval before responding to new users
    allowedChannels: []     # Empty = all channels the bot has access to
    # Or restrict to specific channel IDs:
    # allowedChannels:
    #   - "1234567890123456789"
    #   - "9876543210987654321"

The dmPolicy: "pairing" setting is a security control. With pairing enabled, the bot will not respond to direct messages from unknown users until you explicitly approve each one. This prevents random users from interacting with your agent if they discover your bot's username.

Restart OpenClaw

docker compose down && docker compose up -d

Check the logs to verify the Discord connection was successful:

docker compose logs -f openclaw

You should see a log line indicating that the Discord bot has connected and is ready. Something like:

[discord] Bot connected as YourBotName#1234
[discord] Serving in 1 guild(s)

If you see authentication errors, double-check that the DISCORD_BOT_TOKEN in your .env file is correct and that the bot has not been reset since you copied the token.

Verify the Connection

Go to your Discord server. The bot should now show as online in the member list. Send a message in a channel the bot has access to and verify that it responds. If using dmPolicy: "pairing", you will need to approve the channel or user through OpenClaw before the bot will reply.

Step 7: Channel Permissions and Role-Based Access

A common mistake is giving the bot access to every channel in the server. For production deployments, you should restrict the bot to the channels where it is actually needed.

Create a Dedicated Bot Role

1. In your Discord server, go to Server Settings > Roles
2. Create a new role (e.g., "AI Agent")
3. Configure the role's base permissions to match what the bot needs (same permissions you selected during OAuth2 setup)
4. Assign this role to the bot

Configure Channel-Level Permissions

For each channel in your server, you can override the bot's role permissions:

• Channels where the bot should respond: Ensure the bot role has "View Channel," "Send Messages," and "Read Message History" enabled
• Channels where the bot should NOT respond: Set "View Channel" to denied for the bot role. If the bot cannot see the channel, it cannot read or respond to messages there
• Read-only channels: Grant "View Channel" and "Read Message History" but deny "Send Messages." The bot can monitor the channel without posting

This is particularly important for servers with private or sensitive channels (admin channels, HR discussions, financial planning) where an AI agent should not have access.

Using OpenClaw's allowedChannels Configuration

In addition to Discord's native permission system, OpenClaw supports an allowedChannels list in the configuration file. This is a second layer of restriction: even if the bot has Discord-level permission to see a channel, OpenClaw will ignore messages from channels not on the allowed list.

To find a channel's ID, enable Developer Mode in Discord (User Settings > Advanced > Developer Mode), then right-click any channel and select Copy Channel ID.

channels:
  discord:
    enabled: true
    dmPolicy: "pairing"
    allowedChannels:
      - "1234567890123456789"   # general-support
      - "9876543210987654321"   # ai-help

Using both Discord permissions and OpenClaw's allowed list gives you defense in depth. If someone accidentally grants the bot access to a new channel in Discord's settings, the OpenClaw-level restriction prevents it from responding there.

Step 8: Slash Commands vs. Message-Based Interaction

Discord bots can interact with users in two primary ways: responding to regular messages and responding to slash commands. Each has tradeoffs.

Message-Based Interaction

This is the default mode for OpenClaw's Discord plugin. The bot reads messages in channels it has access to and responds based on its configured behavior. There are a few common patterns:

• @mention trigger: The bot only responds when someone @mentions it (e.g., "@AI Agent what is our refund policy?"). This is the recommended approach for busy servers where you do not want the bot responding to every message.
• Keyword trigger: The bot responds when messages contain specific keywords or phrases. Useful for FAQ-style automation.
• Always-on: The bot responds to every message in its allowed channels. Best for dedicated support channels where every message is directed at the bot.

OpenClaw's default behavior is to respond to @mentions and direct messages. You can customize this in the agent's system prompt and channel configuration.

Slash Commands

Slash commands (like /ask, /help, /status) provide a structured interaction model. Users type / and see a menu of available commands with descriptions and parameters.

Advantages of slash commands:

• Discoverable: users can see available commands without reading documentation
• Structured: you define required and optional parameters with types and descriptions
• Private: slash command responses can be set to "ephemeral" (visible only to the user who ran the command)
• Do not require the Message Content Intent (they work even without privileged intents)

Disadvantages:

• Less natural: users have to know to type / instead of just talking
• Rigid: each command has a fixed structure, which is less flexible than free-form conversation
• Registration: slash commands must be registered with Discord's API and can take up to an hour to propagate globally

Recommended Approach

For most AI agent deployments, the best approach is a hybrid: use @mention-based messaging as the primary interaction model for natural conversation, and register a few slash commands for common actions that benefit from structure.

For example:

• /help - Shows what the agent can do and how to interact with it
• /ask [question] - Ask a question and get a private (ephemeral) response
• /status - Check the agent's status, uptime, and current model
• /feedback [message] - Submit feedback to the team

This gives users both the flexibility of natural language and the discoverability of structured commands.

Security Best Practices for Discord Bots

Discord bots have access to messages, user information, and server data. Securing them is not optional. Here are the practices that matter most.

Bot Token Management

The bot token is the single most sensitive piece of data in your Discord bot setup. If it is compromised, an attacker can:

• Read all messages in every channel the bot has access to
• Send messages as the bot (including phishing links, malware, and spam)
• Access server member data
• Potentially escalate privileges if the bot has elevated permissions

Token security rules:

• Store the token in environment variables or a secrets manager, never in source code
• Never share the token in Discord messages, GitHub issues, or support tickets
• Use chmod 600 on your .env file to restrict read access
• If you suspect a leak, reset the token immediately from the Developer Portal. The old token becomes invalid instantly
• Rotate the token periodically (every 90 days is a reasonable cadence)
• Set up GitHub's secret scanning to alert you if the token is accidentally committed

Permission Scoping

Every permission you grant to the bot is a permission an attacker gets if the bot is compromised. Apply the principle of least privilege aggressively:

• If the bot only reads and sends messages, do not grant "Manage Messages" (which allows deletion)
• If the bot does not need to modify the server, do not grant any management permissions
• Never grant "Administrator" unless there is a specific, documented reason
• Regularly audit the bot's permissions and remove any that are no longer needed

Privileged Gateway Intents and Privacy

Privileged intents exist because they grant access to sensitive data. The Message Content Intent, for example, gives the bot access to the full text of every message in every channel it can see. Consider the implications:

• If you only need the bot in specific channels, restrict access through channel permissions rather than relying solely on OpenClaw's allowedChannels
• If you do not need member join/leave events, disable the Server Members Intent
• If your server handles sensitive conversations (health, financial, legal), carefully consider which channels the bot should have access to

Rate Limiting and Abuse Prevention

Discord has built-in rate limits, but your AI agent also has an API cost per message. Without your own rate limiting, a malicious or over-enthusiastic user can flood the bot with messages and burn through your AI budget.

Consider implementing:

• Per-user message limits (e.g., 20 messages per hour)
• Per-channel limits for busy servers
• A cooldown between responses to prevent conversation loops
• AI budget caps through OpenRouter or your model provider to prevent runaway costs

Audit Logging

Keep logs of your bot's activity: what messages it received, what it responded with, and any tool calls it executed. This is essential for debugging, for monitoring agent behavior, and for compliance if your bot handles business-critical interactions.

Troubleshooting Common Issues

Here are the issues that come up most frequently when setting up Discord bots with OpenClaw, along with their solutions.

"Bot is online but not responding to messages"

This is the single most common issue and it almost always comes down to one of these causes:

1. Message Content Intent not enabled. Go to the Developer Portal > Bot > Privileged Gateway Intents and make sure "Message Content Intent" is toggled on. Without it, the bot receives message events but the content field is empty, so OpenClaw has nothing to process.
2. Bot does not have permission in the channel. Check that the bot's role has "View Channel," "Send Messages," and "Read Message History" in the specific channel where you are testing.
3. DM pairing is enabled. If dmPolicy: "pairing" is set, the bot will not respond until you approve the user or channel. Check OpenClaw's admin interface or logs for pending pairing requests.
4. The bot is configured to respond to @mentions only. Try @mentioning the bot directly: "@YourBot what can you do?"

"403 Forbidden" or "Missing Permissions" Errors

These errors appear in the OpenClaw logs when the bot tries to perform an action it does not have permission for. Common causes:

• The bot's role is below a channel-level permission override that denies access
• The bot was invited without the required permissions. Re-invite with the correct OAuth2 URL
• The server has a verification level that the bot does not meet

Fix: Check the bot's effective permissions in the specific channel using Discord's permission calculator (right-click the channel > Edit Channel > Permissions > check the bot role).

"Invalid Token" or "Authentication Failed"

• The token in your .env file is incorrect. Re-copy it from the Developer Portal
• The token has been reset since you copied it. Each reset invalidates the previous token
• There are extra spaces, newlines, or quotes around the token in your .env file. The value should be the raw token string with no surrounding characters

"Disallowed Intents" Error

This error means your bot is requesting a privileged intent that has not been enabled in the Developer Portal. Go to the Bot page and enable the required intents. If your bot is in 75+ servers and has not been verified, Discord will block privileged intents entirely until the verification process is completed.

Bot is Slow to Respond

Discord expects bots to acknowledge interactions within 3 seconds. If your AI model takes longer to generate a response (which it often will), the interaction may time out. OpenClaw handles this by streaming responses where supported and by sending a "typing" indicator while the model generates its reply.

If responses are consistently slow:

• Check your AI model's latency. Some models (especially larger ones) take 5-10 seconds for the first token
• Verify that the server has enough resources. Underpowered hardware causes queuing delays
• Consider using a faster model for Discord interactions and reserving slower, more capable models for complex tasks

Bot Responds to Itself in a Loop

If the bot is responding to its own messages and creating an infinite conversation loop, check that OpenClaw is correctly filtering bot messages. The Discord plugin should ignore messages from bot users by default, but misconfigurations can cause this behavior. Verify your OpenClaw version is up to date, as older versions had a bug related to self-message filtering.

Advanced Configuration

Once the basics are working, here are some additional configurations that improve the bot's behavior in production.

Custom Status Message

Set a custom status for your bot to help users understand what it does at a glance. In your OpenClaw Discord configuration:

channels:
  discord:
    enabled: true
    dmPolicy: "pairing"
    status:
      type: "watching"        # "playing", "watching", "listening", "competing"
      text: "for support requests"

This makes the bot show "Watching for support requests" as its status in the member list.

Thread Support

Discord threads are a great way to keep conversations organized. When the bot responds to a question, it can automatically create a thread to keep the main channel clean. This prevents long AI conversations from flooding the channel feed.

Embed Formatting

Discord supports rich embeds with colored sidebars, fields, images, and footers. For structured responses (like status reports, search results, or data summaries), embeds are significantly more readable than plain text. OpenClaw's Discord plugin supports embed formatting through its response configuration.

Multi-Server Deployment

A single Discord bot can be in multiple servers simultaneously. Each server has its own channel permissions and role configuration. If you deploy the same bot to multiple community servers, remember that:

• The bot's memory is shared across all servers (unless you configure per-server memory isolation)
• A conversation in Server A could influence responses in Server B if memory is not isolated
• You need sufficient server resources to handle the combined message volume
• Once you pass 75 servers, the verification requirement kicks in

Managed Discord on ClawTrust

If the steps above feel like a lot of configuration work, there is a faster path. ClawTrust includes Discord support on every tier, from Starter ($79/mo) to Enterprise ($299/mo). All 15+ messaging channels are available on all plans.

How It Works on ClawTrust

You still need to create the Discord application and bot in the Developer Portal (Discord requires this for all bots). But after that, the ClawTrust dashboard handles the rest:

1. Dashboard connect: Paste your bot token into the Credentials section of your agent's dashboard. The token is encrypted and stored in ClawTrust's credential vault, separate from the agent's server.
2. Automatic configuration: The Discord plugin is enabled and configured automatically with security best practices (DM pairing, rate limiting, proper intent handling).
3. Credential isolation: Your Discord bot token never sits in a plaintext .env file on the agent's VPS. It is encrypted at rest in the control plane and injected at runtime through a secure channel. Even if the VPS is fully compromised, the token is not accessible to an attacker.
4. Budget controls: AI API costs are capped per agent. A spam attack on your Discord bot burns through the budget, not your credit card. When the budget is reached, the agent pauses gracefully.
5. Health monitoring: ClawTrust checks your agent's health every 15 minutes, including the Discord connection. If the bot disconnects, auto-remediation restarts the connection and you get notified.

What You Get on Each Tier

• Starter ($79/mo): Discord + all other messaging channels, dedicated VPS, $5/mo AI budget, full security hardening, health monitoring
• Pro ($159/mo): Everything in Starter plus agent email identity, more compute, $10/mo AI budget, Python environment, and we configure skills for you
• Enterprise ($299/mo): Everything in Pro plus 8 vCPU/16GB RAM, $30/mo AI budget, dedicated onboarding call, and custom skill development

The total time from creating your Discord application to having a live AI agent responding in your server: about 10 minutes.

For a deep dive on ClawTrust's security architecture, including how credential isolation works and why it matters for bot tokens, see our Security page.

Wrapping Up

Setting up an OpenClaw Discord bot is not inherently difficult, but there are enough moving parts that skipping a step can leave you debugging for hours. The most critical steps are:

1. Enable the Message Content Intent in the Developer Portal. This is the number one cause of "bot is online but does not respond."
2. Scope permissions to the minimum your bot actually needs. Never grant Administrator.
3. Secure your bot token like a password. Environment variables or a secrets manager, never source code.
4. Use dmPolicy: "pairing" to prevent unauthorized users from interacting with your agent.
5. Layer Discord's channel permissions with OpenClaw's allowedChannels for defense in depth.

Discord is one of the most powerful channels for AI agent deployment because of its real-time nature, massive user base, and flexible permission system. Whether you are building a support bot for a SaaS product, a community assistant for an open-source project, or an internal automation agent for your team, Discord gives you the infrastructure to reach users where they already spend their time.

If you are planning to connect your AI agent to other channels as well, check out our guides on Telegram bot setup and Slack integration.

Frequently Asked Questions

Does the Discord bot work with slash commands and regular messages?

Yes. OpenClaw's Discord plugin supports both slash commands and message-based interaction. The recommended approach is to use @mention-based messaging as the primary mode and register a few slash commands for structured actions like /help or /ask.

Is the Message Content Intent required for slash commands?

No. Slash commands work without the Message Content Intent because Discord delivers slash command data directly to the bot, separate from the message event system. However, if you also want the bot to read and respond to regular messages, you need the intent enabled.

Can I use the same bot in multiple Discord servers?

Yes. A single Discord bot can be in multiple servers. Each server has independent channel permissions and role configurations. Be aware that memory may be shared across servers unless you configure per-server isolation, and that passing 75 servers triggers Discord's bot verification requirement.

What happens when my bot reaches 75 servers?

Discord requires bot verification for bots in 75 or more servers that use privileged intents. If your bot is not verified and it reaches this threshold, privileged intents (including Message Content) stop working. Start the verification process early at discord.com/developers if you expect to grow beyond 75 servers.

How much does it cost to run a Discord bot with OpenClaw?

Discord itself is free. The costs come from the server running OpenClaw ($5-25/mo self-hosted) and AI model API usage ($10-100+/mo depending on volume). On ClawTrust, plans start at $79/mo all-inclusive with AI credits and spending controls. The AI budget is the main variable; a busy Discord server with hundreds of messages per day will consume more budget than a quiet one.

Can I restrict the bot to only respond when @mentioned?

Yes. This is the recommended configuration for busy servers. Configure the bot's system prompt and channel settings so it only processes messages that @mention it directly. This prevents the bot from consuming AI budget on every message in a channel and keeps the conversation focused.

How do I handle file attachments and images in Discord?

OpenClaw's Discord plugin supports receiving file attachments and images from users. When a user sends an image, it can be processed through the agent's vision capabilities (if the configured model supports vision). Outbound file sharing is also supported. The bot can attach files to its responses, which is useful for generating reports, screenshots, or documents.

Is there a way to make bot responses private (visible only to the user)?

Yes, through slash commands with ephemeral responses. When a user runs a slash command, the response can be flagged as ephemeral, meaning only that user can see it. This is useful for sensitive queries (like account status or personal information) in public channels. Regular message responses are always visible to everyone in the channel.

---

Chris DiYanni is the founder of ClawTrust. Previously at Palo Alto Networks, SentinelOne, and PagerDuty. He builds security infrastructure so businesses can trust their AI agents with real work.