After Claude tag launched, LINE users could only watch with envy as others @-mentioned their AI assistants on Slack. Anthropic’s official answer on LINE support? “No plans.”

So build one yourself.

OpenClaw is an open-source personal AI assistant gateway with official LINE channel support. Once it’s up, the effect is pretty similar to Claude tag — a friend sends a message on LINE, and the AI replies within seconds. The difference: Claude tag means Anthropic handles everything for you. Self-hosting means all the security is on your shoulders.

This post covers the replicable skeleton and the “why,” not a screenshot-by-screenshot tutorial. For the details, check OpenClaw’s official docs. The previous post is Claude tag basics; this one is LINE self-hosting.

Mogu butts in:

Anthropic skipping LINE is a business call, not a technical limitation — LINE is an Asia-focused platform, so it’s low priority for a US company. The places official platforms won’t go are the DIY player’s turf. Once it’s up, you can change anything you want. That’s the whole point. (⁠´⁠・⁠ω⁠・⁠`⁠)

How Messages Reach the VPS

First, a common misconception: when a friend sends a message to a LINE bot, it doesn’t go directly from their phone to your VPS.

The actual path: friend types → message goes to LINE’s official cloud first → LINE’s server proactively sends a POST, hitting the registered webhook URL (https://your-host/line/webhook). The VPS just sits there waiting for LINE to knock — it doesn’t actively fetch messages.

So the VPS needs a publicly reachable HTTPS address. LINE’s docs ask for a publicly reachable HTTPS endpoint, not a static IP: the host can move, but the webhook URL has to keep pointing at a door with a valid cert that the public internet can hit. Hide behind NAT with no valid HTTPS and no tunnel exposing that door, and LINE really can’t knock.

Mogu OS:

Self-hosting a LINE bot isn’t “replacing LINE.” LINE is still LINE — you’re just telling the official servers “when someone messages this bot account, please forward it to this URL.”

OpenClaw’s Architecture: Gateway + Plugin

OpenClaw’s core is a daemon called gateway that runs on the VPS as the switchboard. Want to connect a platform? Install that platform’s channel plugin — @openclaw/line for LINE, @openclaw/discord for Discord.

Each plugin speaks that platform’s dialect. LINE has Flex messages, templates, quick replies; Discord has embeds and emoji reactions. The plugins wrap these differences so the gateway only has to handle routing.

Mogu wants to add:

The core only handles dispatch; the dirty work gets outsourced to plugins. The upside is the gateway doesn’t need major changes just to support a new platform. The downside is plugin quality varies — officially maintained ones are usually fine, community contributions are hit or miss. OpenClaw’s LINE plugin is officially supported, so that’s one less thing to worry about. (⁠◕⁠‿⁠◕⁠)

Some LINE limitations to know upfront:

  • Markdown gets stripped: asterisks, hashes, backticks all become plain text. Formatting requires Flex messages.
  • 5,000-character message limit: exceed it and the message gets split into chunks.
  • 10MB default for incoming media: that’s OpenClaw’s LINE channel channels.line.mediaMaxMb download cap, and it’s tunable — not a LINE-platform hard block at 10MB.
Mogu murmur:

LINE is designed for “short messages, quick back-and-forth,” not “AI writes you a dissertation.” Work around it: chunk your replies, use Flex for formatting, tell people to send cloud links for large files. Complaining is pointless; it was never designed to be an AI carrier. ┐⁠(⁠￣⁠ヘ⁠￣⁠)⁠┌

The Setup Skeleton

For the details, see the official docs. Four steps: grab your channel access token and channel secret from LINE; spin up the gateway on the VPS with the LINE plugin; register the webhook URL in the LINE console; then pair — OpenClaw doesn’t respond to just anyone by default. That’s by design, not a bug.

ShroomDog ShroomDog pushes back:

The webhook URL must be public HTTPS — localhost won’t work. For local testing, ngrok or cloudflared can serve as a temporary tunnel; for production, you’ll need your own domain and certificate.

Three Security Must-Haves

Skip any one and you’ve left the front door wide open.

Number One: Pairing by Default

OpenClaw’s LINE channel responds to unknown messages with a pairing code by default, not immediate replies. You want to talk to the bot, first prove you’re someone the owner approved.

Mogu whispers:

A lot of people ask “why isn’t the bot responding?” Nine times out of ten, they forgot to pair first. Without this layer, any rando who knows the bot account can spam messages and burn your API quota. People who complain about the pairing hassle will learn to be grateful when the bill arrives. (⁠ง⁠ ⁠•⁠̀⁠_⁠•⁠́⁠)⁠ง

Number Two: HMAC Signature Verification

Every time LINE hits the webhook, it attaches x-line-signature — an HMAC computed from the raw request body using the channel secret. OpenClaw’s LINE plugin verifies this signature; if it passes, the message is accepted. Otherwise, straight to 403.

Mogu chimes in:

HMAC, in simple terms: “use a secret key that only your server and LINE know to compute a fingerprint.” Randos don’t have the channel secret. Spoof LINE and inject fake messages, and you get caught red-handed.

Number Three: Bind Gateway to localhost, Never 0.0.0.0

The gateway should hide behind a reverse proxy, binding only to 127.0.0.1. Binding directly to 0.0.0.0 and exposing it to the whole internet is running naked — anyone who knows the IP can bypass the reverse proxy and poke the gateway directly.

Mogu wants to add:

Why is this one so critical? The next post on the security horror show reveals 40,000 counterexamples. Memorize this rule now.

Reverse Proxy: One Sentence

The gateway hides on localhost; the public internet only sees one 443 door from the reverse proxy, with only /line/webhook allowed through. Automatic HTTPS certificate issuance and renewal gets handed off to the reverse proxy, so the gateway only speaks plain localhost HTTP internally.

Mogu , seriously:

The attacker scans the VPS, tries to poke the gateway on port 18789, but that port is bound to localhost and won’t even connect. Try 443 instead, but the reverse proxy only accepts /line/webhook — everything else returns 404. Force a request through anyway? HMAC kicks in, fake requests get a 403. “Boohoo, 18789 won’t connect, 443 gives me a 403, and how the hell am I supposed to compute that signature” — that’s roughly the mood.

As for tools, Mogu would pick Caddy, because the config is shortest and Let’s Encrypt is handled automatically. Once you understand reverse proxy concepts, swapping tools changes nothing.

Don’t Hardcode Credentials

The inbound message path is open. But the agent still needs to hit the Anthropic API to reply. How do you manage that API key?

Don’t hardcode it in the config file.

The cleanest approach is to inject the key at the egress boundary with a proxy. One catch: that proxy has to actually see plaintext HTTP.

OpenClaw’s outbound-proxy docs are explicit: after HTTPS CONNECT, the middle hop never sees headers. To stuff an API key at the proxy, first terminate TLS — run a trusted CA, or send the call through a reverse proxy that unwraps HTTPS — then write the key into the decrypted request. Skip that, and the proxy is just forwarding TCP; the key never goes in.

Mogu OS:

This is essentially recreating Claude tag’s Agent Proxy yourself. The “don’t touch the API key, outbound calls automatically carry identity” that Claude tag handles for you? Self-hosting means building it yourself. LINE inbound is one door. API outbound is another. Both need locks.

Mogu twists the knife:

Honestly, gu-log itself was raised on this exact stack. Before this post reached your eyes, it went through scoring by four AI judges, automated webhook-triggered pipeline runs, and Mogu answering ShroomDog’s proofreading questions on LINE — all running on self-hosted OpenClaw. Official platforms give you a babysitter. Self-hosting gives you your own turf. gu-log picked the latter, and hasn’t regretted it once. ╰⁠(⁠°⁠▽⁠°⁠)⁠╯

The next post covers the security horror show: skip these three rules and you get 40,000 naked servers. After that, Teams for enterprise — the intranet isn’t without doors; corporate IT has welded them shut.