diff --git a/extensions/mattermost/src/mattermost/slash-http.test.ts b/extensions/mattermost/src/mattermost/slash-http.test.ts
index ede51a06ea6..c4469b9cad9 100644
--- a/extensions/mattermost/src/mattermost/slash-http.test.ts
+++ b/extensions/mattermost/src/mattermost/slash-http.test.ts
@@ -10,9 +10,10 @@ function createRequest(params: {
   body?: string;
   contentType?: string;
 }): IncomingMessage {
-  const req = new PassThrough() as IncomingMessage;
-  req.method = params.method ?? "POST";
-  req.headers = {
+  const req = new PassThrough();
+  const incoming = req as unknown as IncomingMessage;
+  incoming.method = params.method ?? "POST";
+  incoming.headers = {
     "content-type": params.contentType ?? "application/x-www-form-urlencoded",
   };
   process.nextTick(() => {
@@ -21,7 +22,7 @@ function createRequest(params: {
     }
     req.end();
   });
-  return req;
+  return incoming;
 }
 
 function createResponse(): {
diff --git a/extensions/mattermost/src/mattermost/slash-http.ts b/extensions/mattermost/src/mattermost/slash-http.ts
index f152f79b7c7..963d1c9475d 100644
--- a/extensions/mattermost/src/mattermost/slash-http.ts
+++ b/extensions/mattermost/src/mattermost/slash-http.ts
@@ -185,7 +185,12 @@ async function authorizeSlashInvocation(params: {
   const configAllowFrom = normalizeAllowList(account.config.allowFrom ?? []);
   const configGroupAllowFrom = normalizeAllowList(account.config.groupAllowFrom ?? []);
   const storeAllowFrom = normalizeAllowList(
-    await core.channel.pairing.readAllowFromStore("mattermost").catch(() => []),
+    await core.channel.pairing
+      .readAllowFromStore({
+        channel: "mattermost",
+        accountId: account.accountId,
+      })
+      .catch(() => []),
   );
   const effectiveAllowFrom = Array.from(new Set([...configAllowFrom, ...storeAllowFrom]));
   const effectiveGroupAllowFrom = Array.from(
@@ -254,6 +259,7 @@ async function authorizeSlashInvocation(params: {
       if (dmPolicy === "pairing") {
         const { code } = await core.channel.pairing.upsertPairingRequest({
           channel: "mattermost",
+          accountId: account.accountId,
           id: senderId,
           meta: { name: senderName },
         });
diff --git a/extensions/mattermost/src/mattermost/slash-state.ts b/extensions/mattermost/src/mattermost/slash-state.ts
index a8590c403f2..26a2ed029c6 100644
--- a/extensions/mattermost/src/mattermost/slash-state.ts
+++ b/extensions/mattermost/src/mattermost/slash-state.ts
@@ -305,6 +305,7 @@ export function registerSlashCommandRoute(api: OpenClawPluginApi) {
   for (const callbackPath of callbackPaths) {
     api.registerHttpRoute({
       path: callbackPath,
+      auth: "plugin",
       handler: routeHandler,
     });
     api.logger.info?.(`mattermost: registered slash command callback at ${callbackPath}`);