OpenClaw Keybase Plugin

An OpenClaw plugin that enables encrypted messaging via Keybase.

Features

• Direct Messages: Send and receive encrypted DMs
• Team Channels: Support for Keybase team channels
• Multi-account: Configure multiple Keybase bot accounts
• Pairing Flow: Secure user approval system
• Allowlists: Control who can message your bot
• Mention Gating: Configure when bot responds in groups

Prerequisites

1. Keybase account - Create one at https://keybase.io for your bot
2. Paper key - Generate from Settings > Devices > Add a device > Paper key
3. Keybase binary - Install from https://keybase.io/download and ensure it's on your PATH

Installation

Install via the OpenClaw CLI:

openclaw plugins install @ephb/openclaw-keybase

Or install from a local checkout:

openclaw plugins install ./path/to/openclaw-keybase-plugin

Configuration

Minimal Configuration

{
  channels: {
    keybase: {
      enabled: true,
      username: "mybot",
      paperkey: "word1 word2 word3 word4 word5 word6 word7 word8",
      dm: { policy: "pairing" },
    },
  },
}

Production Configuration (using file for paper key)

{
  channels: {
    keybase: {
      enabled: true,
      username: "mybot",
      paperkeyFile: "/run/secrets/keybase-paperkey",
      dmPolicy: "pairing",
    },
  },
}

Environment Variables

Alternatively, you can use environment variables:

• KEYBASE_USERNAME - Bot username
• KEYBASE_PAPERKEY - Paper key for login
• KEYBASE_BINARY - Path to keybase binary if not on PATH

Multi-account Setup

{
  channels: {
    keybase: {
      accounts: {
        work: {
          username: "workbot",
          paperkeyFile: "/run/secrets/keybase-work",
          dmPolicy: "allowlist",
          allowFrom: ["colleague1"],
        },
        personal: {
          username: "personalbot",
          paperkeyFile: "/run/secrets/keybase-personal",
          dmPolicy: "pairing",
        },
      },
    },
  },
}

Access Control

DM Policies

Policy	Behavior
"pairing" (default)	Unknown senders get a pairing code; approve via openclaw pairing approve
"allowlist"	Only usernames in allowFrom can DM
"open"	Anyone can DM (requires allowFrom: ["*"] as safety confirmation)
"disabled"	DMs are silently dropped

Team Channel Policies

Policy	Behavior
"allowlist" (default)	Only teams listed in teams are monitored
"open"	All team channels the bot can see are monitored
"disabled"	Team channel messages are silently dropped

Target Format

Keybase targets used in routing and openclaw message send:

Type	Format	Example
DM	<username> or user:<username>	alice
Team channel	<team>#<channel> or team:<team>#<channel>	myteam#general

Verification

After installation and configuration:

openclaw plugins enable keybase
openclaw channels status --probe

Troubleshooting

Common issues:

• "keybase: command not found" - The keybase binary is not on PATH. Install it or set channels.keybase.keybasePath.
• "need username and paperkey" - Both username and a paper key source are required.
• Bot not responding in teams - Check groupPolicy and teams config.
• Bot not responding to DMs - Check dmPolicy and allowFrom.
• Paper key rejected - Ensure the full key is provided without extra whitespace.

License

MIT

Contributing

Contributions are welcome! Please open an issue or pull request on GitHub.

Links

• OpenClaw
• Keybase
• Keybase Bot Library