Connecting to StandIn

StandIn is the hosted media bridge that joins the Microsoft Teams call and connects it to your agent. This page explains the connection model and the three tiers you can connect through.

The connection model

Your plugin runs a WebSocket server inside the OpenClaw gateway. StandIn is the client: for each call it opens an authenticated WebSocket to your plugin and streams audio/video over it. You do not dial out and you never handle Teams media yourself.

Teams call <-> StandIn media bridge ==WebSocket (StandIn dials in)==> @komaa/openclaw-msteams-bridge

What you configure to make this work:

Setting	Why
bindAddress	Set to 0.0.0.0 so the hosted bridge can reach the plugin. Default 127.0.0.1 is local-only.
port	The port the plugin listens on (default 9442). Make it reachable by StandIn.
path	The WebSocket route (default /msteams/calling).
secret	The HMAC secret. It must match the value StandIn uses, or the handshake is rejected.

Every connection is authenticated with a replay-proof HMAC handshake - see the Wire Protocol. This is the same regardless of which tier you use; only the identity and limits differ. For the bigger picture of what runs where, see Architecture.

Keep the secret a secret

The shared secret authenticates every media connection and signs outbound place-call requests. Store it as an OpenClaw secret reference rather than a literal string in production, and rotate it on the StandIn side and in the plugin config together.

The three tiers

Pick a tier by where you are in your journey. From the plugin’s side the mechanics are identical - you always get a shared secret and StandIn dials in.

Sandbox - try it in minutes

• What it is: a shared StandIn bot that joins a Teams meeting you generate. No Azure/Teams bot of your own required.
• Limits: time-limited (about 5 minutes/day per session).
• Use it for: your first call and quick experiments.
• Start: standin.komaa.com/sandbox - it walks you through generating a meeting link and gives you the connection secret to paste into secret.

Free - develop with your own bot

• What it is: the developer tier. You bring your own Microsoft Teams bot (an Azure Bot) and pair it in the StandIn dashboard. Pairing issues the shared secret for that identity.
• Limits: daily-capped (5 minutes/day), on its own slot.
• Use it for: building and testing against a real inbound number/identity you control.
• Start: standin.komaa.com - create an account and pair your bot.

Subscription - production

• What it is: your own Teams bot with no daily cap, managed in the StandIn dashboard.
• Use it for: real, always-on deployments.
• Start: standin.komaa.com.

Note

For account, dashboard, and bot-pairing specifics (creating the Azure Bot, entering credentials, retrieving the secret), follow the StandIn docs at docs.komaa.com. Those steps live on the StandIn side; this plugin only needs the resulting secret.

The Managed Bot connection (no Azure bot)

On the Managed Bot path StandIn owns the Teams bot, so there is nothing to pair: you connect the agent in the StandIn portal and paste the connection secret it issues.

One secret covers both lanes of that connection:

• Calling - the media WebSocket, wss://<your-host>/msteams/calling
• Messages - the Teams chat relay, https://<your-host>/msteams/messages

They are two lanes of a single binding, not two products. The one secret authenticates both - you do not set a separate secret for the messages lane.

"msteams-bridge": {
  "config": {
    "enabled": true,
    "secret": "paste-the-value-from-the-StandIn-portal"
  }
}

The sections below - pairing, bot credentials, your own Teams channel - are BYO only.

Pairing your own Teams bot

When you move past the sandbox, you register your Teams bot with OpenClaw’s Teams chat channel and pair it with StandIn for voice. The Teams bot credentials are supplied to OpenClaw through the channel environment variables:

Env var	Meaning
MSTEAMS_APP_ID	Your Teams bot (Azure Bot) app id
MSTEAMS_APP_PASSWORD	The bot app secret
MSTEAMS_TENANT_ID	Your Microsoft Entra (AAD) tenant id

Pairing in the StandIn dashboard links that bot identity to a shared secret; put the secret in secret. From then on, inbound calls to your bot are bridged to your plugin.

Restricting who can reach the agent

Inbound calls are gated by policy, and the gate is closed until you open it: with inboundPolicy unset (or disabled), every inbound call is rejected.

• inboundPolicy: disabled | allowlist | pairing | open. Unset = deny all.
• allowFrom: the allowed callers, matched by AAD object id (case-insensitive) or phone number (digits only).

The usual progression: open for your first sandbox call, then allowlist + allowFrom for everything after.

Note

pairing currently behaves exactly like allowlist - the plugin issues no per-call pairing codes; callers must be present in allowFrom.

Caution

open accepts any caller who reaches your bot. Use it for sandbox testing only.

See the Configuration Reference for details.

Cutoff and the spoken goodbye

When a tier limit is reached mid-call (sandbox time cap, free daily budget, or a paid max-minutes governor), StandIn sends an assistant.say message with a short goodbye line. The agent speaks it, then the call ends gracefully rather than cutting off abruptly.