Slack Developer Platform

researched 2026-05-25· 31 sources · 6 concepts · skill slack-dev

Use when building Slack apps, calling Web API methods, building Block Kit UIs, handling Events, configuring OAuth, or using the Slack MCP server. For auditing slash command registrations, orphaned sub

When to use this skill

Use when building Slack apps, calling Web API methods, building Block Kit UIs, handling Events, configuring OAuth, or using the Slack MCP server. For auditing slash command registrations, orphaned subscriptions, or bot token scope creep, use slack-subscription-auditor instead. [source]

Core Concepts

Web API - HTTP RPC at https://slack.com/api/METHOD.name. NOT REST. [source]
Events API - Slack POSTs events to your URL when things happen. Requires URL verification challenge. [source]
Socket Mode - WebSocket-based alternative to Events API. No public URL needed. [source]
Block Kit - JSON schema for rich UI in messages, modals, and Home tab. [source]
Interactive Components - Buttons, select menus, modals. Slack POSTs interaction payloads to your app. [source]
Slash Commands - /command invocations. Slack POSTs form data to your URL. [source]

Request/Response Pattern

Always check ok: true before using response data. [source]

Token Rotation

Opt in via App Settings → Manage Distribution → Rotate Tokens. Expiring tokens include refresh_token; call tooling.tokens.rotate before expiry. All tokens can be revoked with auth.revoke. [source]

3. Slack CLI Reference

Install: curl -fsSL https://downloads.slack-edge.com/slack-cli/install.sh | bash [source]

4. Web API

Base URL: https://slack.com/api/ [source]
Auth: Authorization: Bearer <token> header (never query string) [source]

Rate Limits

On 429, Slack returns Retry-After header. Always implement exponential backoff. [source]

chat.postMessage — Key Arguments

Response includes ts (unique message ID) and channel. [source]

Setup

App Config → Event Subscriptions → Enable Events [source]
Set Request URL (must respond to verification challenge) [source]
Subscribe to events (bot / workspace scopes) [source]

Interaction Payloads

POSTed to your interactivity_url: [source]
trigger_id expires in 3 seconds - use immediately to open modals. [source]

6. Socket Mode

Requirements: Enable Socket Mode in App Config; generate an App-Level Token (xapp-) with connections:write scope. App cannot be published to Slack Marketplace. [source]
Multi-connection: Up to 10 simultaneous WebSocket connections per app. All connections receive identical events. [source]

Blocks (Top-Level)

Limits: 50 blocks per message, 100 per modal/Home tab. [source]

8. Modals and Views

View stack operations: views.open (requires trigger_id) → views.push → views.update. Stack limit: 3 views deep. [source]
Handling submission: [source]
Private metadata: max 3000 chars, URL-encoded string. Use JSON.stringify({}) to pass structured data. [source]

Bolt for JavaScript

Required env vars: [source]

10. Slack MCP Server

Transport: JSON-RPC 2.0 over Streamable HTTP [source]
Endpoint: https://mcp.slack.com/mcp [source]
Auth: Confidential OAuth 2.0 (user tokens) [source]
Availability: Marketplace-published and internal apps only (unlisted apps prohibited) [source]

Config

Partner MCP clients: Claude.ai, Claude Code, Perplexity, Cursor. [source]

11. Agents and AI Apps

Enable: App Settings → Agents & AI Apps → Toggle on. [source]

Key Events for Agents

Required scopes: assistant:write, chat:write, im:history [source]

12. Real-Time Search (RTS) API

GA February 2026. Allows real-time searches across Slack workspace data for AI agent RAG patterns without external data storage. [source]
Availability: Directory-published and internal apps only [source]
Auth: User token (xoxp-) required - bot tokens not supported [source]
Use case: AI agent RAG, context retrieval, real-time data freshness [source]
Launch partners: Claude.ai, Google Agentspace, Dropbox Dash, Perplexity Enterprise, Notion AI. [source]

13. Work Objects

GA October 2025. Transform static content from third-party services into interactive, dynamic experiences combining unfurls with a rich flexpane detail view. [source]

Implementation Flow

Docs: https://docs.slack.dev/messaging/work-objects [source]

15. Deprecation and Migration Timeline

Classic apps → Granular permissions: Map each classic scope to its granular equivalent. New apps require OAuth with granular xoxb- tokens. [source]

16. Sources

Slack Developer Docs [source]
Slack Web API Reference [source]
Slack CLI Docs [source]
Slack MCP Server [source]
Agents & AI Apps [source]
Work Objects [source]
RTS API [source]
Changelog [source]

17. 2026 Q1–Q2 Platform Delta (added 2026-06-10)

Verified against the official changelog (docs.slack.dev/changelog) and Slack dev blog, accessed 2026-06-10. Confidence tags as elsewhere. [source]
Slack MCP Server expanded (2026-05-13): tool surface now 13 - added add_reaction, create_conversation, list_channel_members, list_emoji, read_files; per-app toggle via manifest settings.is_mcp_enabled (CLI 4.1.0). Directory-published or internal apps only. [HIGH] [source]
Block Kit agent components: Alert, Card, Carousel blocks (2026-04-16); data table block GA (2026-05-20); "Thinking Steps" streaming chunks (task_card/plan/url-source via chat.startStream/appendStream/stopStream, chunks + task_display_mode params, 2026-02-11); Work Object slugs/unfurls + Code block announced. [HIGH] [source]
Agent Developer Kit / CLI 4.x (2026-04-10+): slack create agent templates (Bolt JS/Python × Claude Agent SDK / OpenAI Agents SDK / Pydantic AI, MCP pre-wired); slack env commands, slack docs search, file-watch live reload; generic slack api <method> (4.1.0) and --no-auth (4.2.0, 2026-06-03); Bolt JS 4.7.x / Bolt Python 1.28.0 add sayStream + listener setStatus. [HIGH] [source]
Auth deltas: PKCE GA (2026-03-30) - public-client flag is one-way; custom-URI installs always receive rotating tokens; PKCE refresh tokens expire after 30 days; desktop redirects can't request bot scopes. Optional OAuth scopes GA (2026-03-16) via oauth_config.scopes.bot_optional/user_optional - handle missing_scope. assistant.threads.setStatus now prefers chat:write; assistant:write on that method will eventually be dropped (2026-03-05). [HIGH] [source]
New Web API params (2026-06-03): authorship (icon_emoji/icon_url/username) on assistant.threads.setStatus + chat.startStream; highlight_type on files.completeUploadExternal/filesUploadV2. [HIGH] [source]
Events API: Delayed Events retry (2026-02-05) replays events missed during app outages. [HIGH] [source]
Rate limits: the 1 req/min / 15-object conversations.history/replies limit for commercially distributed non-Marketplace apps reportedly extended to EXISTING unlisted installs on 2026-03-03, ending grandfathering (practitioner-corroborated; the live doc page wording lags - [MEDIUM]). Internal apps and Marketplace apps remain exempt. [source]
SUPERSEDES §15 row: the classic-app sunset (table above says Nov 16, 2026) was paused indefinitely on 2025-12-08 - classic apps continue to work; no new ones can be created. [HIGH] [source]
Deno SDK: alive (2.15.2, 2026-02-26) but de-emphasized - agent templates are Bolt-only; Bolt is the strategic path. [MEDIUM] [source]
Ecosystem sentiment [MEDIUM]: prominent criticism (Fivetran "Anthropic, please make a new Slack"; HN 2026-06) that rate limits + RTS no-store/no-train terms wall customer data off from external AI; Marketplace listing is the only viable path for history-reading commercial apps. [source]

Children

Slack Web API (frontier)
Slack Events API (frontier)
Socket Mode (frontier)
Slack CLI (frontier)
Authentication and Tokens (frontier)

Frontier under this node: Authentication and Tokens, Slack CLI, Slack Events API, Slack Web API, Socket Mode

← the whole tree · 3D view· how to read this page