Quickstart

Pick your runtime. Both paths get you to a live Teams call where your agent answers in voice.

Prerequisites

A working OpenClaw or Hermes Agent install (the host).
A StandIn account (standin.komaa.com) - the hosted media bridge that joins the Teams call and connects to your plugin. No worker to run. A paid plan is not required to start: the free identity gives you one BYO-bot identity with 5 minutes of call time per day included.
Your own Microsoft Teams bot (an Azure AD app) connected to StandIn - see the Teams setup to create and upload it.

This quickstart is the standard setup: you connect your own Microsoft Teams bot and callers dial it. To try StandIn with no Azure bot (a shared bot joins a public meeting you generate), use the Sandbox (community tier) instead. The sandbox is metered: 5 minutes of bot time per day per room, up to 5 new rooms per day, one bot per meeting, and a 7-day room link, with the call ending at the daily limit.

A realtime voice provider key (for realtime mode) - e.g. OpenAI or Azure OpenAI. Streaming mode uses your host’s configured STT/TTS instead.

Install (one line)

The installer detects your OpenClaw or Hermes install, adds the matching plugin, and prompts for the settings (mode, shared secret, provider API key + model, inbound call policy). On a re-run every prompt defaults to your current configuration, so pressing Enter keeps each value. Linux / macOS / WSL

curl -fsSL https://standin.komaa.com/install.sh | bash

Windows (PowerShell)

irm https://standin.komaa.com/install.ps1 | iex

It also runs non-interactively - pass flags (--runtime, --mode, --secret, --provider, --api-key, --model, --port) or set the matching STANDIN_* environment variables.

For secrets (--secret, --api-key), prefer the STANDIN_SECRET / STANDIN_API_KEY environment variables over CLI flags, so the values do not land in your shell history. The installer never transmits your secrets: they are only written to your local plugin config.

Connect your agent by pairing (recommended)

Pairing is the zero-config way to connect a subscribed identity: the installer exposes your voice endpoint, sends StandIn the exact wss://host:<voicePort> URL, and delivers the generated shared secret back to the installer automatically. There are no ports to configure and nothing to copy by hand, which avoids the most common first-call issue (a domain saved without its voice port, so StandIn dials the wrong port and the bot silently never joins).

Run the installer and choose Pair

Run the one-line installer on the machine your agent runs on. When it asks “Pair this agent with StandIn now?”, choose Pair. It prints an 8-character code.

Enter the code at standin.komaa.com/pair

Sign in at standin.komaa.com/pair and enter the code. StandIn shows you the exact voice endpoint and port your agent proposed - confirm it and approve. If you run the official msteams channel plugin, the installer already collected your Azure bot App ID, client secret, and tenant from its config and sent them with the pairing, so the credential fields arrive pre-filled (the secret is consumed server-side and never shown in the browser). Otherwise the installer prompts you for them, or you type them here.

Done

The installer picks up the shared secret on its next poll and finishes. Your identity provisions and StandIn dials your agent - you never type a voice URL, a port, or a secret.

At the approve step you choose what the pairing becomes: a paid identity (consumes a plan slot), a free identity (your own Azure bot, 5 minutes/day included, one per account), or the sandbox (no Azure bot at all - a shared StandIn bot joins a meeting StandIn generates; see the Sandbox (community tier)).

Free identity vs Sandbox: which am I?

Two free ways to run StandIn - pick by whether you have an Azure bot:

You run the official msteams channel plugin (so you already have an Azure Bot App ID + secret; this is the normal OpenClaw/Hermes Teams journey): use a Free identity. It is the same BYO-bot setup as paid - your own bot, your own tenant, inbound calls to your own Teams identity - with 5 minutes of call time per day included, one free identity per account, held alongside any paid identities.
You have no Azure bot (you never installed the msteams channel plugin and just want to hear your agent talk): use the sandbox (community tier). A shared StandIn bot joins a public meeting StandIn generates - zero Azure setup.

If you already run the Teams msteams plugin, use a Free identity instead of the sandbox - the sandbox joins a second (shared) bot, so two bots will be in the meeting, both wired to the same agent.

First chat message ignored? The two runtimes gate DMs differently. OpenClaw drops DMs from unapproved senders silently by default (dmPolicy: pairing) - approve yourself once with openclaw pairing approve msteams <CODE>. Hermes replies to an unknown sender with a pairing code instead of silence - approve it with hermes pairing approve teams <CODE>; only when TEAMS_ALLOWED_USERS is set are unlisted senders dropped silently. See Troubleshooting.

Verify (optional)

Prefer not to pipe a script straight into your shell? Download it, review it, then run it:

macOS / Linux
Windows (PowerShell)

Download:

curl -fsSL https://standin.komaa.com/install.sh -o install.sh

Review it:

less install.sh

Run it:

bash install.sh

Download:

irm https://standin.komaa.com/install.ps1 -OutFile install.ps1

Review it:

notepad install.ps1

Run it:

./install.ps1

Always fetch over HTTPS from standin.komaa.com. The installer never transmits your secrets; they are only written to your local plugin config.

Manual install

Prefer to wire it up by hand? Pick your runtime:

OpenClaw (npm)
Hermes (pip)

Install

openclaw plugins install npm:@komaa/openclaw-msteams-bridge

The package ships prebuilt (v0.1.10+), so there is no build step - install and go.

Also on ClawHub: openclaw plugins install clawhub:@komaa/openclaw-msteams-bridge (OpenClaw falls back to npm automatically if the ClawHub fetch fails). See the plugin README.

Configure

Add a msteams-voice entry to your OpenClaw config - sharedSecret must match the value you set in StandIn:

{
  "plugins": {
    "entries": {
      "msteams-voice": {
        "config": {
          "enabled": true,
          "mode": "realtime",
          "port": 9442,
          "path": "/voice/msteams/stream",
          "sharedSecret": "<same secret as in your StandIn dashboard>",
          "inboundPolicy": "allowlist",
          "allowFrom": ["<caller AAD object id>"],
          "realtime": {
            "provider": "openai",
            "providers": {
              "openai": { "apiKey": "<key>", "model": "gpt-realtime" }
            }
          }
        }
      }
    }
  }
}

Full reference → OpenClaw configuration.

Run + call

Start the gateway (openclaw gateway run), then in your StandIn dashboard register your Agent voice URL (wss://<your-public-host>:8443/voice/msteams/stream via the funnel; local bind ws://<host>:9442/...) and the matching secret. Place a Teams call to your bot.

Install

Into the same Python environment as Hermes:

uv pip install --python /path/to/hermes/venv/bin/python "hermes-msteams-bridge[documents]"

The [documents] extra enables show_file document rendering and the progress panel. Enablement happens in the config below: teams_call under plugins.enabled is all Hermes needs.

Configure

In ~/.hermes/config.yaml under plugins.entries.teams_call.config (secrets in .env):

plugins:
  enabled: [teams_call]
  entries:
    teams_call:
      config:
        shared_secret: ${TEAMS_CALL_SHARED_SECRET}   # must match the secret set in StandIn
        host: 127.0.0.1
        port: 8443
        # Inbound caller policy: Hermes has no `inboundPolicy` key and no
        # pairing mode for calls - the allowlist IS the policy. Empty means
        # deny all inbound callers (set `allow_all: true` to opt out).
        allowlist: ["<caller AAD object id>"]
        realtime:
          backend: azure
          azure_endpoint: https://<your-azure-resource>.cognitiveservices.azure.com
          azure_deployment: gpt-realtime
          api_key: ${AZURE_FOUNDRY_API_KEY}

Full reference → Hermes configuration.

Run + call

hermes teams-call serve --handler realtime

In your StandIn dashboard, register your Agent voice URL (wss://<your-public-host>:8443/voice/msteams/stream via the funnel; local bind ws://<host>:8443/...) and the matching secret, then place a Teams call to your bot.

StandIn connects to your plugin from the internet, so its WebSocket must be reachable - expose it via a public URL or a tunnel (e.g. Tailscale), not loopback-only. Default ports 9442 (OpenClaw) / 8443 (Hermes); path /voice/msteams/stream. A sharedSecret mismatch fails the HMAC handshake silently - the most common first-call issue.

Streaming mode (no realtime key needed) is a one-line change - see Modes.

Getting Started

Teams setup

Concepts

OpenClaw plugin

Hermes plugin

ElevenLabs bridge

LiveKit bridge

OpenAI bridge

Deepgram bridge

Cartesia bridge

Prerequisites

Install (one line)

Connect your agent by pairing (recommended)

Free identity vs Sandbox: which am I?

Verify (optional)

Manual install

​Prerequisites

​Install (one line)

​Connect your agent by pairing (recommended)

​Free identity vs Sandbox: which am I?

​Verify (optional)

​Manual install

Prerequisites

Install (one line)

Connect your agent by pairing (recommended)

Free identity vs Sandbox: which am I?

Verify (optional)

Manual install