Your Telegram accounts are business assets, and connecting them to any platform deserves scrutiny. Here is how GramClaw handles security, and what remains in your hands.
The starting principle: GramClaw never has your Telegram password. Accounts are linked through a secure connection flow that you approve from your own device, producing a session — not a credential — and you can sever that session at any time by disconnecting the account.
How GramClaw protects you
- No stored passwords: connections use an approved-session flow, never saved credentials.
- Scoped API keys: every key is limited to the scopes you grant (read / send) and only to your workspace's accounts.
- Keys shown once: the full gc_live_… key appears only at creation, so it cannot be casually re-read later.
- Instant revocation: deleting a key or disconnecting an account takes effect immediately.
- Individual team logins: teammates get their own accounts — collaboration never requires sharing a password.
- Payments through Stripe: card details go to Stripe, not to GramClaw's servers.
Good practices on your side
- Treat API keys like passwords: store them in a secrets manager, never in shared docs or code repositories.
- Use read-only scopes wherever possible — most dashboards and reports never need send.
- Create one key per integration so revoking one never breaks the others.
- Revoke keys you no longer use, and rotate keys when someone with access leaves the team.
- Only invite trusted teammates — a workspace shares its conversations by design.
- Enable two-step verification inside Telegram itself; it protects the underlying accounts everywhere, not just here.
If something looks wrong
- 1
Revoke exposed keys first
Delete any suspect API key in Settings → API Keys — it stops working the moment it is deleted.
- 2
Check connected sessions in Telegram
In the Telegram app, review active sessions and terminate anything you do not recognize.
- 3
Disconnect and reconnect the account
Disconnecting in GramClaw severs the session; reconnect through the secure flow when things are clean.
- 4
Review your workspace members
Make sure everyone with access still should have it.