AI generated, checked against Slack docs on 2026-10-31: Provider OAuth rules and review policies change frequently. Always verify current submission requirements with the official Slack documentation before submitting for production approval.

Slack

EASYFrom official docs

Self-serve internal install and public distribution; review is only required if choosing to list in the Slack Marketplace.

api.slack.comAI generated, checked against Slack docs on 2026-10-31

At a glance

Executive breakdown in plain language

Difficulty

EASY

Self-serve internal install and public distribution; review is only required if choosing to list in the Slack Marketplace.

Setup Time

10 - 20 minutes

Active engineering effort required to register the OAuth app, set redirect URLs, and obtain credentials.

Approval Wait

Instant for private & public distribution; Slack Marketplace review is a separate stepFrom official docs

Public distribution (Manage Distribution, Activate Public Distribution) lets other workspaces install your app and does not require Slack Marketplace review. A Marketplace listing is a separate step and does add a review.

Biggest Blocker

Workspace administrator restricts non-approved third-party apps

Fix: Submit an in-workspace request to the Slack admin, or create a free personal Slack workspace for staging and development.

Required Before Starting

From official docs

• A Slack workspace where you have admin or app creation permissions (From official docs)

• HTTPS redirect URL (or localhost for development) (From official docs)

• Valid privacy policy URL (if distributing publicly) (From official docs)

• App icon (512x512 PNG) and short description (From official docs)

Step-by-Step Setup Guide

4 steps

From official docs

Follow these sequential actions to register your OAuth application and configure endpoints.

Create an App via Manifest or Scratch

Go to api.slack.com/apps and click 'Create New App'. Selecting 'From an app manifest' allows pasting a YAML/JSON file with all permissions pre-configured.

Open in Slack Console

Configure OAuth Redirect URLs & Scopes

Under 'OAuth & Permissions', add your redirect URL. Select Bot Token Scopes (e.g. chat:write, channels:read, users:read) based on the actions your agent will perform.

Open in Slack Console

Install to Workspace for Immediate Testing

Click 'Install to Workspace' in the sidebar. Confirm permissions to generate a Bot User OAuth Token (`xoxb-...`) that can be used immediately.

Open in Slack Console

Activate Public Distribution

Under 'Manage Distribution', complete the checklist and click 'Activate Public Distribution' to let other workspaces install your app. This does not require Slack Marketplace review. A Marketplace listing is a separate step and does add a review.

Open in Slack Console

Common Blockers & Fixes

3 blockers

Community reported

Anticipate the pitfalls and approval rejections that catch most agent developers off guard.

Workspace administrator restricts non-approved third-party apps

Community reported

Action Plan: Submit an in-workspace request to the Slack admin, or create a free personal Slack workspace for staging and development.

Redirect URI mismatch error during OAuth code exchange

Action Plan: Verify that the redirect URL in your authorization request matches character-for-character the URL whitelisted under OAuth & Permissions.

Scope escalation invalidates previous user tokens

Action Plan: When adding new scopes, prompt existing users to re-authorize before making API calls with newly requested capabilities.

What an agent can do vs what you must do

Agent vs Developer

From official docs

A clear division of labor: tasks your autonomous agent can handle vs actions requiring human developer authorization.

What an Agent Can Do

Generate the complete Slack App Manifest (YAML/JSON) with required scopes and events
Implement the OAuth 2.0 exchange route and token storage
Handle Slack event subscriptions and URL verification challenges (`url_verification`)

What You Must Do Yourself

Log in to api.slack.com and create the application
Authorize the installation in the target Slack workspace
Copy Client ID and Client Secret into the environment variables (`.env`)
Submit for Slack Marketplace review only if choosing to list publicly in the Marketplace (optional)

Managed OAuth vs Custom Credentials

Evaluate whether using a managed integration platform (like Composio) is sufficient or if you must create your own app.

This tool was built for a Composio assignment, and Composio sells managed OAuth.

When Managed OAuth is Enough

Using Composio or a managed OAuth provider is sufficient when building an internal AI agent or multi-tenant app where users connect their individual Slack workspaces via standard OAuth. This tool was built for a Composio assignment, and Composio sells managed OAuth.

When Custom Credentials are Required

You must register a custom Slack OAuth app if you require bespoke bot branding (custom name/avatar in Slack channels), enterprise Grid approval, or private slash commands.

Key Claims & Verification Status

From official docs

Specific factual statements evaluated against sources.

Apps do not need Slack review or approval to be installed on development or private workspaces.

Granular bot scopes are strictly enforced and cannot be changed dynamically per authorization.

Official Sources & Documentation

3 sources

From official docs

Slack API: Distributing Slack Apps Slack API: Quickstart Guide Slack API: Installing with OAuth

Open Questions & Uncertainties

1 open questions

Unverified estimate

Areas currently subject to policy changes or requiring ongoing real-world verification.

How frequently does Slack audit enterprise workspace apps that use wide conversation history scopes without listing on the Marketplace?