Teams want OpenClaw inside Slack without managing another SaaS black box. This 2026-05-22 playbook shows how to run the gateway on a headless NodeMac Mac mini M4, choose Socket Mode versus HTTP webhook ingress, wire scopes safely, and ship three repeatable business workflows—support triage, Friday metrics digest, and deployment notifications—with tables and eight SSH-friendly steps.
OpenClaw acts as a long-running Node.js gateway—default loopback ws://127.0.0.1:18789—that routes Slack events to your model and tools. On a leased Mac mini M4 you keep the process on dedicated Apple Silicon metal in Hong Kong, Japan, Korea, Singapore, or the United States, SSH for automation, and VNC only when macOS privacy UI blocks headless setup. The decision that blocks most rollouts is not the model—it is whether Slack connects through Socket Mode (outbound-only) or an HTTP webhook (public HTTPS endpoint).
Prerequisites on NodeMac before you create the Slack app
- Gateway running under launchd: Label
ai.openclaw.gatewayhealthy—see Node.js PATH alignment (2026-05-21) if installs fail. - Node.js ≥ 22.19 on the service user PATH;
openclaw doctorclean. - Outbound HTTPS from the Mac mini M4 to Slack APIs (no inbound required for Socket Mode).
- Secrets storage: Bot token and signing secret in Keychain or
~/.openclaw/.envoutside synced folders—never commit tokens to git.
First-time gateway setup: headless onboard checklist. Outbound alert patterns: Slack/Discord outbound webhooks guide. Region placement: 2026-05-19 region runbook. Help center · pricing.
Socket Mode vs HTTP webhook: pick the right ingress
Document the choice in your architecture decision record. Switching later requires Slack app reconfiguration and a maintenance window.
| Dimension | Socket Mode | HTTP webhook |
|---|---|---|
| Network | Mac initiates outbound WebSocket to Slack | Slack POSTs to your public HTTPS URL |
| Firewall / NAT | Ideal for headless Mac mini M4 with no inbound ports | Requires reverse proxy, TLS cert, stable DNS |
| Secrets | App-level token + bot token | Signing secret + request URL verification |
| Reconnect | Gateway must stay up; watch gateway.log |
Slack retries on 5xx; endpoint must respond < 3 s |
| NodeMac default | Recommended for leased metal | Use when compliance mandates inbound audit trail |
Slack scopes: minimum viable vs optional power
Start with the smallest scope set that supports your sandbox channel. Expand only after security review—over-scoped bots are a common audit finding.
| Scope / capability | Tier | Use on NodeMac |
|---|---|---|
| app_mentions:read | Minimum | @OpenClaw in #openclaw-sandbox |
| chat:write | Minimum | Replies and digest posts |
| channels:history (bot) | Optional | Thread context for triage workflows |
| reactions:read | Optional | Emoji ack for long-running agent jobs |
| files:write | Optional | Friday chart uploads from gateway skills |
Eight-step Slack + OpenClaw rollout (SSH-first)
- Create Slack app: Enable Socket Mode (or Event Subscriptions for HTTP), add bot scopes from the table above, install to workspace.
- Store tokens on the Mac mini M4: Bot token, signing secret, and app-level token in Keychain or
~/.openclaw/.envwith 600 permissions. - Confirm gateway:
launchctl print gui/$(id -u)/ai.openclaw.gatewayrunning; health probe 3000 ms on loopback. - Wire Slack channel in OpenClaw config: Point connector at Socket Mode or webhook URL; restart gateway via
launchctl kickstart -k. - Sandbox test: Post in
#openclaw-sandbox; verify~/.openclaw/logs/gateway.logshows event delivery within 5 s. - Enable one skill: e.g. standup digest cron (Friday 17:00 local) with channel allow-list.
- Production cutover: Invite bot to operational channels; document on-call runbook with token rotation steps.
- Monitor: Alert on gateway exit codes and Slack API 429 rate limits; keep doctor diagnostics in weekly fleet checks.
Business workflow — support triage: Route #support-escalation mentions to OpenClaw on a Singapore Mac mini M4. The agent summarizes thread history (optional channels:history), drafts a reply, and posts a human-approved message—cutting median first response by roughly 40% when the gateway stays healthy.
FAQ: OpenClaw Slack on Mac mini M4
Socket Mode or HTTP webhook for NodeMac?
Prefer Socket Mode on leased headless Mac mini M4 hosts: no inbound firewall rules, no TLS termination on the gateway host, and simpler compliance narratives. Choose HTTP only when security policy requires auditable inbound HTTP.
Which scopes first?
app_mentions:read plus chat:write for sandbox; add history and files scopes when workflows need context or attachments.
Gateway up but Slack silent?
Check Socket Mode enabled, app-level token valid, bot invited to channel, and outbound HTTPS from the Mac. Tail gateway.log; run openclaw doctor if Node drifted after brew upgrade.
Running OpenClaw in Slack on NodeMac means treating the Mac mini M4 as a always-on integration appliance: Apple Silicon M4 unified memory for concurrent tool calls, native macOS for launchd reliability, SSH for token rotation and log tails, VNC only for permission dialogs. Leasing in Hong Kong, Japan, Korea, Singapore, or the United States keeps Slack RTM/WebSocket paths short without buying hardware. Compare dedicated Mac mini M4 monthly rates on the pricing page before you spend another sprint on webhook plumbing that Socket Mode would have avoided.