slack-auth-security

name	slack-auth-security
description	OAuth flows, token management, and security best practices for Slack apps. Use when implementing app distribution, multi-workspace installations, token storage and rotation, managing scopes and permissions, or securing production Slack applications.
keywords	["slack","oauth2","authentication","security","token-management"]

Slack Auth & Security

OAuth 2.0 Flow

Bot Token vs User Token

Bot Token (xoxb-):

• Performs actions as the bot user
• Requires bot scopes
• Recommended for most operations

User Token (xoxp-):

• Acts on behalf of specific user
• Requires user scopes
• Used for user-specific operations

Basic OAuth Flow

import "github.com/slack-go/slack"

// Step 1: Generate authorization URL
state := generateRandomState()
authURL := fmt.Sprintf(
    "https://slack.com/oauth/v2/authorize?client_id=%s&scope=%s&state=%s",
    clientID,
    "chat:write,channels:read",
    state,
)

See oauth-flow.md for complete OAuth implementation.

Token Management

Storing Tokens Securely

// NEVER hardcode tokens
// Use environment variables or secrets manager
token := os.Getenv()
api := slack.New(token)