VerifiedResearched 2026-10-28Confidence high

Slack

Slack Technologies (Salesforce) · slack.com · Developer portal

Tier 2 · Self-serve, optional reviewCustomer-side gate

Any workspace can install your app without review. The deciding factor is the read limit: unlisted apps read history once a minute, 15 messages per call. Production needs a Marketplace listing.

sourced

inferred

sourced

Customer-side gate: Workspace owners can require app approval, so members can only request your app. On Enterprise Grid, org policy can require approval per workspace, and org-wide installs need an Org Admin.

App types (4)

Internal app (your own workspace only): Prototyping, or a customer building in their own workspace. Normal conversations.history limits (50+ requests a minute, up to 1,000 messages per call).
Unlisted distributed app (public distribution, not in the Marketplace): Pilots. Any workspace can install it without review. New installs get conversations.history and conversations.replies once a minute, 15 messages per call.
Slack Marketplace app: Commercial scale. Needs 10 active workspaces to submit, then about 12 weeks of review. Restores normal history limits.
Org-ready app (Enterprise orgs): Enterprise Grid customers wanting one install across workspaces. Opt in to org-level apps; an Org Admin approves.

Docs read(reached)
Endpoints probed(reached)
Portal checked(reached)
Set up by a person(not reached)

Evidence: 0 tested, 2 probed, 30 sourced, 2 inferred

Generate a live guide to compare with this one.

Next step

Create the app You10 min

At api.slack.com/apps, click Create New App. Choose From scratch or From a manifest and pick your workspace. Basic Information shows the client ID and secret.

https://api.slack.com/apps

0 of 13

What does your agent need?

Select everything it does. Scopes decide the tier.

3Your tier: Review requiredThe provider must approve the app before users outside your test list can connect.

This is the hardest marked scope. If lighter scopes cover your use case, you need tier 2 (Self-serve, optional review).

Start today

Composio-managed OAuth: Yes

sourced

Composio provides managed OAuth for Slack and a separate Slackbot toolkit. Users see Composio on the install screen, and you share its quota. Bring your own app for your own name, scopes, or rate limits. Only new connections use it. Existing users stay on the old one until they reconnect or you import their credentials. Ask Composio whether its app is Marketplace-listed, since that sets your history limit.

Time and effort

You can build while you wait.

Stage	Who can connect	Hands-on	Waiting	Review
Prototype	Your own workspace only. sourced Slack uses OAuth v2 at slack.com/oauth/v2/authorize. The redirect_uri must be HTTPS, match or sit under a configured Redirect URL, and match between steps or you get bad_redirect_uri. Codes expire after 10 minutes. Tokens do not expire unless rotation is on. Some scopes fail org installs with scope_not_allowed_on_enterprise. Installing with OAuth sourced · official docs · 2026-10-28 sourced From May 29, 2025, new unlisted apps and new installs of existing unlisted apps can call conversations.history and conversations.replies 1 time a minute with a limit of 15 objects. Marketplace apps are not affected. Internal customer-built apps keep 50+ a minute and 1,000 objects. Rate limit changes for non-Marketplace apps sourced · official forum or blog · 2026-10-28 sourced Marketplace AI apps must not train models on Slack data, must disclose the model, data retention, tenancy, and residency, must warn about inaccurate output, and agent container apps must disclose the paid plan need. Agent apps may not store Slack data they obtain. Slack Marketplace app guidelines and requirements sourced · official policy · 2026-10-28	1 h to 3 h	none	No
Limited beta	Any workspace via your install link, unless admins require approval. sourced After you activate public distribution, any workspace can install the app unless it limits installs to admins, to Marketplace apps, or requires admin approval. Redirect, events, and interactivity URLs need SSL. Unlisted distribution is meant for pilots and early customers. Distributing your app sourced · official docs · 2026-10-28 sourced From May 29, 2025, new unlisted apps and new installs of existing unlisted apps can call conversations.history and conversations.replies 1 time a minute with a limit of 15 objects. Marketplace apps are not affected. Internal customer-built apps keep 50+ a minute and 1,000 objects. Rate limit changes for non-Marketplace apps sourced · official forum or blog · 2026-10-28 sourced The updated API terms name the Slack Marketplace as the only appropriate channel for commercially distributing apps, including unlisted ones. Slack says the history limit is meant to stop bulk data exfiltration by unvetted apps. Rate limit changes for non-Marketplace apps (FAQ) sourced · official forum or blog · 2026-10-28 sourced Workspace owners can require approved apps under App management settings. Members then request apps and owners or app managers approve them. On Enterprise Grid, an org app management policy turns on approval for the workspace. Manage app approval for your workspace sourced · official docs · 2026-10-28 sourced Slack's changelog says the new limits are not applied to existing installations of unlisted apps. Rate limit changes for non-Marketplace apps sourced · official forum or blog · 2026-10-28 sourced A community article says the grace period for existing unlisted installs ended March 3, 2026. It links no Slack source and conflicts with Slack's changelog. Slack just throttled your OpenClaw agent sourced · community · 2026-10-28 sourced A news report says Slack capped conversations.history and conversations.replies at 1 request a minute and 15 messages for apps not in the Marketplace, starting May 29, 2025 for new apps and new installs. Marketplace apps keep normal limits. Slack adds a 1 per minute limit to some APIs for non-Marketplace apps (Japanese) Independent second source for the history limit. It also says existing installs would be limited from September 2, 2025, which Slack's changelog no longer says. sourced · community · 2026-10-28 sourced Activating public distribution gives you an Add to Slack button and a shareable install URL. Many users will need admin approval before they can install your app. Get to know the Slack app types (Trailhead) Second source for self-serve distribution. It does not mention any Slack review step for distributed apps. sourced · official docs · 2026-10-28	3 h to 10 h	unknown	No
Production	Any workspace, from the Marketplace, with normal history limits. sourced Marketplace apps with fewer than 10 active workspaces and fewer than 10 weekly active users are unsuitable. :history, files:read, search:read. and admin.* scopes get enhanced review. Restricted scopes such as search:read and admin.* are generally rejected. Slack Marketplace app guidelines and requirements sourced · official policy · 2026-10-28 sourced Preliminary review feedback takes up to 10 business days and functional review up to 10 weeks for new apps (6 weeks for updates). Resubmitting in the preliminary stage resets your queue place. Slack does not expedite for launch dates. Slack Marketplace review guide sourced · official docs · 2026-10-28 sourced As of July 2026, Marketplace submissions need at least 10 installs on active workspaces, up from a temporary lower threshold, and must stay at 10 or more for the whole review. Updated installation requirement for Slack Marketplace apps sourced · official forum or blog · 2026-10-28 sourced Apps must be installed on 10 or more active workspaces, used in the past 28 days, or they are blocked from submitting to the Marketplace. Slack Marketplace review guide sourced · official docs · 2026-10-28	15 h to 40 h	Provider says: 1 to 84 daysDevelopers report: 14+ days	Yes

Prototype: Internal apps keep normal history limits. Test summarization here. Use a free developer sandbox for paid-plan features like the agent container.
Limited beta: No Slack review. You wait only on customer admins who require approval. Slack intends unlisted distribution for pilots.
Production: You need 10 active workspaces through the whole review. Slack states up to 10 business days for preliminary feedback and up to 10 weeks for functional review. Resubmitting during preliminary review resets your queue place. No verified developer reports exist.

Scopes

Scopes that match your selection are marked.

Reply and post as a botNo review · Write data
chat:write app_mentions:read assistant:write im:history
Any workspace, no review. Reply to mentions and DMs via events. Tokens do not expire unless rotation is on.
sourced
Slack uses OAuth v2 at slack.com/oauth/v2/authorize. The redirect_uri must be HTTPS, match or sit under a configured Redirect URL, and match between steps or you get bad_redirect_uri. Codes expire after 10 minutes. Tokens do not expire unless rotation is on. Some scopes fail org installs with scope_not_allowed_on_enterprise.
Installing with OAuth
sourced · official docs · 2026-10-28
sourced
After you activate public distribution, any workspace can install the app unless it limits installs to admins, to Marketplace apps, or requires admin approval. Redirect, events, and interactivity URLs need SSL. Unlisted distribution is meant for pilots and early customers.
Distributing your app
sourced · official docs · 2026-10-28
sourced
assistant:write is a bot scope that lets the app act as an AI assistant app and call assistant.threads.setStatus, setSuggestedPrompts, and setTitle.
assistant:write scope
sourced · official docs · 2026-10-28
Read channels in real time (events)No review · Read data, Act while offline
channels:history groups:history
No review while unlisted. Message events arrive live from channels the bot is in. Fetching older threads still hits the 1 per minute limit.
sourced
channels:history lets the app view messages in public channels it has been added to. It covers conversations.history, conversations.replies, and message events such as message.channels.
channels:history scope
sourced · official docs · 2026-10-28
inferred
An unlisted app can read new messages through Events API message events without calling conversations.history, so the reduced limit mostly hurts backfill and on-demand thread reads.
The rate limit change names only conversations.history and conversations.replies. channels:history also grants message events. Not tested, and Marketplace AI rules still discourage storing message data.
inferred · reasoning · 2026-10-28
sourced
From May 29, 2025, new unlisted apps and new installs of existing unlisted apps can call conversations.history and conversations.replies 1 time a minute with a limit of 15 objects. Marketplace apps are not affected. Internal customer-built apps keep 50+ a minute and 1,000 objects.
Rate limit changes for non-Marketplace apps
sourced · official forum or blog · 2026-10-28
Read history on demand at full speedReview · Read data, Act while offline
channels:history groups:history im:history mpim:history
Full limits only for internal and Marketplace apps. A Marketplace listing puts *:history scopes under enhanced review.
sourced
From May 29, 2025, new unlisted apps and new installs of existing unlisted apps can call conversations.history and conversations.replies 1 time a minute with a limit of 15 objects. Marketplace apps are not affected. Internal customer-built apps keep 50+ a minute and 1,000 objects.
Rate limit changes for non-Marketplace apps
sourced · official forum or blog · 2026-10-28
sourced
Marketplace apps with fewer than 10 active workspaces and fewer than 10 weekly active users are unsuitable. *:history, files:read, search:read.* and admin.* scopes get enhanced review. Restricted scopes such as search:read and admin.* are generally rejected.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
sourced
Preliminary review feedback takes up to 10 business days and functional review up to 10 weeks for new apps (6 weeks for updates). Resubmitting in the preliminary stage resets your queue place. Slack does not expedite for launch dates.
Slack Marketplace review guide
sourced · official docs · 2026-10-28
inferred
An agent that reads threads on demand across many customer workspaces needs a Marketplace listing to work well in production.
At 1 call a minute and 15 messages per call, catching up on a busy channel takes many minutes per workspace. Only Marketplace and internal apps get normal limits, and Slack's terms point commercial apps to the Marketplace.
inferred · reasoning · 2026-10-28
Search and adminPartner only · Read data, Admin-level
search:read admin.*
Restricted scopes. Marketplace generally rejects them, and admin.* rarely passes outside Slack's partner program. Use the Real-time Search API for search.
sourced
Marketplace apps with fewer than 10 active workspaces and fewer than 10 weekly active users are unsuitable. *:history, files:read, search:read.* and admin.* scopes get enhanced review. Restricted scopes such as search:read and admin.* are generally rejected.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
sourced
On February 17, 2026 Slack released an MCP server and the Real-time Search API, which grew out of the Data Access API and lets apps fetch relevant Slack data without storing it.
Announcing the Slack MCP server and Real-time Search API
Read from the changelog index page at docs.slack.dev/changelog.
sourced · official forum or blog · 2026-10-28

Requirements

Steps

Prototype

Create the appYou10 min
At api.slack.com/apps, click Create New App. Choose From scratch or From a manifest and pick your workspace. Basic Information shows the client ID and secret.
https://api.slack.com/apps
probed
Developer portal api.slack.com/apps loads and asks you to sign in to your Slack account to create an app.
Slack API: Applications
HTTP 200, page title Slack API: Applications.
probed · probe · 2026-10-28
Add scopes and redirect URLYou15 min
Under OAuth & Permissions, add bot scopes such as chat:write, app_mentions:read, and channels:history, and your HTTPS redirect URL. Mark nice-to-have scopes optional.
sourced
Slack uses OAuth v2 at slack.com/oauth/v2/authorize. The redirect_uri must be HTTPS, match or sit under a configured Redirect URL, and match between steps or you get bad_redirect_uri. Codes expire after 10 minutes. Tokens do not expire unless rotation is on. Some scopes fail org installs with scope_not_allowed_on_enterprise.
Installing with OAuth
sourced · official docs · 2026-10-28
sourced
Since March 16, 2026 you can mark individual OAuth scopes as optional, so users can install without granting them.
Optional scopes have landed
Read from the changelog index page at docs.slack.dev/changelog.
sourced · official forum or blog · 2026-10-28
Turn on Agents if neededYou10 min
For the split-view agent container, turn on Agents and add assistant:write. Some AI features need a paid plan, so test in a free sandbox and confirm free plans still work.
sourced
Marketplace AI apps must not train models on Slack data, must disclose the model, data retention, tenancy, and residency, must warn about inaccurate output, and agent container apps must disclose the paid plan need. Agent apps may not store Slack data they obtain.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
sourced
assistant:write is a bot scope that lets the app act as an AI assistant app and call assistant.threads.setStatus, setSuggestedPrompts, and setTitle.
assistant:write scope
sourced · official docs · 2026-10-28
sourced
After you create an agent app, app settings show an Agents feature in the sidebar and the assistant:write scope. Some AI features need a paid plan, and a free Developer Program sandbox has them.
Developing agents
sourced · official docs · 2026-10-28
Subscribe to message eventsAgent30 min to 2 hours
Under Event Subscriptions, set an HTTPS request URL and subscribe to app_mention, message.im, and message.channels.
sourced
channels:history lets the app view messages in public channels it has been added to. It covers conversations.history, conversations.replies, and message events such as message.channels.
channels:history scope
sourced · official docs · 2026-10-28
inferred
An unlisted app can read new messages through Events API message events without calling conversations.history, so the reduced limit mostly hurts backfill and on-demand thread reads.
The rate limit change names only conversations.history and conversations.replies. channels:history also grants message events. Not tested, and Marketplace AI rules still discourage storing message data.
inferred · reasoning · 2026-10-28
Install and testYou30 min
Install the app, invite the bot to a test channel, and summarize a thread.
sourced
From May 29, 2025, new unlisted apps and new installs of existing unlisted apps can call conversations.history and conversations.replies 1 time a minute with a limit of 15 objects. Marketplace apps are not affected. Internal customer-built apps keep 50+ a minute and 1,000 objects.
Rate limit changes for non-Marketplace apps
sourced · official forum or blog · 2026-10-28

Limited beta

Build the OAuth flowAgent2 to 4 hours
Redirect to slack.com/oauth/v2/authorize with client ID, scopes, state, and redirect_uri. Verify state, exchange the code with oauth.v2.access within 10 minutes, and store the token by team or enterprise ID.
https://docs.slack.dev/authentication/installing-with-oauth/
sourced
Slack uses OAuth v2 at slack.com/oauth/v2/authorize. The redirect_uri must be HTTPS, match or sit under a configured Redirect URL, and match between steps or you get bad_redirect_uri. Codes expire after 10 minutes. Tokens do not expire unless rotation is on. Some scopes fail org installs with scope_not_allowed_on_enterprise.
Installing with OAuth
sourced · official docs · 2026-10-28
probed
The authorization endpoint slack.com/oauth/v2/authorize is live.
Slack authorize endpoint probe
GET with an invalid client ID returned HTTP 200 and a small page whose script redirects to the same URL with tracked=1. We did not follow it, so we did not see the error shown for an unknown client.
probed · probe · 2026-10-28
Decide on token rotationYou15 min
Rotation gives 12-hour access tokens and single-use refresh tokens, and cannot be turned off. Without it, tokens do not expire. Confirm Composio or your broker handles rotation first.
sourced
With token rotation, access tokens last 12 hours and each refresh token works once. Rotation cannot be turned off once on. Without rotation, access tokens never expire.
Using token rotation
sourced · official docs · 2026-10-28
Activate public distributionYou15 min
In Manage Distribution, complete the checklist and click Activate Public Distribution. You get an Add to Slack button and install link.
sourced
After you activate public distribution, any workspace can install the app unless it limits installs to admins, to Marketplace apps, or requires admin approval. Redirect, events, and interactivity URLs need SSL. Unlisted distribution is meant for pilots and early customers.
Distributing your app
sourced · official docs · 2026-10-28
sourced
Activating public distribution gives you an Add to Slack button and a shareable install URL. Many users will need admin approval before they can install your app.
Get to know the Slack app types (Trailhead)
Second source for self-serve distribution. It does not mention any Slack review step for distributed apps.
sourced · official docs · 2026-10-28
Opt in to org-level installsYou1 to 3 hours
For Enterprise Grid, add a bot scope like team:read, choose Opt-In under Org Level Apps, and handle is_enterprise_install. An Org Admin installs and picks workspaces.
https://docs.slack.dev/enterprise/developing-for-enterprise-orgs/
sourced
To support org-wide installs you add a bot scope, opt in under Org Level Apps (org_deploy_enabled), and an Org Admin approves and installs the app, then chooses workspaces.
Developing for Enterprise orgs
sourced · official docs · 2026-10-28
Send pilots the admin noteYou15 min per customer
App approval is off by default but common at large companies and on Enterprise Grid. Send each pilot's workspace owner the admin note draft.
sourced
Workspace owners can require approved apps under App management settings. Members then request apps and owners or app managers approve them. On Enterprise Grid, an org app management policy turns on approval for the workspace.
Manage app approval for your workspace
sourced · official docs · 2026-10-28

Production

Reach 10 active workspacesYouweeks, depends on your sales
Keep 10 non-sandbox workspaces active in the last 28 days, through the whole review.
sourced
Marketplace apps with fewer than 10 active workspaces and fewer than 10 weekly active users are unsuitable. *:history, files:read, search:read.* and admin.* scopes get enhanced review. Restricted scopes such as search:read and admin.* are generally rejected.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
sourced
As of July 2026, Marketplace submissions need at least 10 installs on active workspaces, up from a temporary lower threshold, and must stay at 10 or more for the whole review.
Updated installation requirement for Slack Marketplace apps
sourced · official forum or blog · 2026-10-28
sourced
Apps must be installed on 10 or more active workspaces, used in the past 28 days, or they are blocked from submitting to the Marketplace.
Slack Marketplace review guide
sourced · official docs · 2026-10-28
Submit the listingYou1 to 3 days
Publish landing, privacy, and support pages. In Submit to the Slack Marketplace, pass automated checks and add the listing, scope reasons, test account, and a demo video of install, use, and uninstall.
https://docs.slack.dev/slack-marketplace/slack-marketplace-review-guide/
sourced
Listings need a short description of 10 words or fewer, 1600x1000 images under 2MB, a public landing page, a privacy policy covering collection, use, retention, and deletion, and support that answers within 2 business days.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
sourced
Preliminary review feedback takes up to 10 business days and functional review up to 10 weeks for new apps (6 weeks for updates). Resubmitting in the preliminary stage resets your queue place. Slack does not expedite for launch dates.
Slack Marketplace review guide
sourced · official docs · 2026-10-28
sourced
Reviewers install the app in their own workspace, test install, OAuth, use, and uninstall, and check a reason for each scope. A demo video is recommended.
Slack Marketplace review guide
sourced · official docs · 2026-10-28
Wait for reviewProvider (wait)Up to about 12 weeks, as Slack states
Slack checks the listing, then a reviewer tests the app. Answer all feedback. Slack does not expedite for launch dates.
sourced
Preliminary review feedback takes up to 10 business days and functional review up to 10 weeks for new apps (6 weeks for updates). Resubmitting in the preliminary stage resets your queue place. Slack does not expedite for launch dates.
Slack Marketplace review guide
sourced · official docs · 2026-10-28
sourced
Reviewers install the app in their own workspace, test install, OAuth, use, and uninstall, and check a reason for each scope. A demo video is recommended.
Slack Marketplace review guide
sourced · official docs · 2026-10-28

Blockers

conversations.history returns 15 messages and rate limits after one call a minute.
Cause: Distributed apps outside the Marketplace get the reduced limit on new installs.
Fix: Read from events, queue history fetches, and get Marketplace approval for full speed.
Help: Ask Slack developer support if your app counts as commercially distributed.
sourced
From May 29, 2025, new unlisted apps and new installs of existing unlisted apps can call conversations.history and conversations.replies 1 time a minute with a limit of 15 objects. Marketplace apps are not affected. Internal customer-built apps keep 50+ a minute and 1,000 objects.
Rate limit changes for non-Marketplace apps
sourced · official forum or blog · 2026-10-28
inferred
An unlisted app can read new messages through Events API message events without calling conversations.history, so the reduced limit mostly hurts backfill and on-demand thread reads.
The rate limit change names only conversations.history and conversations.replies. channels:history also grants message events. Not tested, and Marketplace AI rules still discourage storing message data.
inferred · reasoning · 2026-10-28
sourced
Slack rate limit tiers are per method, per workspace, per app: Tier 1 is 1+ a minute and Tier 3 is 50+ a minute.
Rate limits
sourced · official docs · 2026-10-28
Members can only request the app.
Cause: The workspace requires approved apps.
Fix: Send the workspace owner the admin note draft with your scope list.
sourced
Workspace owners can require approved apps under App management settings. Members then request apps and owners or app managers approve them. On Enterprise Grid, an org app management policy turns on approval for the workspace.
Manage app approval for your workspace
sourced · official docs · 2026-10-28
bad_redirect_uri during token exchange.
Cause: redirect_uri differs between authorize and oauth.v2.access, or is not under a configured Redirect URL.
Fix: Send the same HTTPS redirect_uri in both and add it under OAuth & Permissions.
sourced
Slack uses OAuth v2 at slack.com/oauth/v2/authorize. The redirect_uri must be HTTPS, match or sit under a configured Redirect URL, and match between steps or you get bad_redirect_uri. Codes expire after 10 minutes. Tokens do not expire unless rotation is on. Some scopes fail org installs with scope_not_allowed_on_enterprise.
Installing with OAuth
sourced · official docs · 2026-10-28
Marketplace submission is blocked or returned early.
Cause: Fewer than 10 active workspaces, before or during review.
Fix: Grow non-sandbox installs active in the last 28 days.
sourced
Marketplace apps with fewer than 10 active workspaces and fewer than 10 weekly active users are unsuitable. *:history, files:read, search:read.* and admin.* scopes get enhanced review. Restricted scopes such as search:read and admin.* are generally rejected.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
sourced
As of July 2026, Marketplace submissions need at least 10 installs on active workspaces, up from a temporary lower threshold, and must stay at 10 or more for the whole review.
Updated installation requirement for Slack Marketplace apps
sourced · official forum or blog · 2026-10-28
Marketplace review flags your *:history scopes.
Cause: History scopes get enhanced review, and broad access without a clear use rarely passes.
Fix: Limit history to channels the bot is in, and explain and demo the exact feature.
sourced
Marketplace apps with fewer than 10 active workspaces and fewer than 10 weekly active users are unsuitable. *:history, files:read, search:read.* and admin.* scopes get enhanced review. Restricted scopes such as search:read and admin.* are generally rejected.
Slack Marketplace app guidelines and requirements
sourced · official policy · 2026-10-28
The app stops working after a person leaves.
Cause: Apps with scopes beyond bot, commands, webhooks, or identify are uninstalled when the installer leaves or becomes a guest.
Fix: Handle app_uninstalled and prompt reinstall; prefer bot scopes.
sourced
Apps with scopes other than bot, incoming-webhook, commands, or identify are uninstalled when the installing user leaves the workspace or becomes a guest.
Distributing your app
sourced · official docs · 2026-10-28
Refresh fails, or tokens stop after 12 hours.
Cause: Rotation is on and you reused a refresh token, which works once after a short grace period.
Fix: Store the newest refresh token from every refresh.
sourced
With token rotation, access tokens last 12 hours and each refresh token works once. Rotation cannot be turned off once on. Without rotation, access tokens never expire.
Using token rotation
sourced · official docs · 2026-10-28
Org install fails with scope_not_allowed_on_enterprise.
Cause: Some scopes are not allowed on org-level installs.
Fix: Remove the scope or use a workspace-level install.
sourced
Slack uses OAuth v2 at slack.com/oauth/v2/authorize. The redirect_uri must be HTTPS, match or sit under a configured Redirect URL, and match between steps or you get bad_redirect_uri. Codes expire after 10 minutes. Tokens do not expire unless rotation is on. Some scopes fail org installs with scope_not_allowed_on_enterprise.
Installing with OAuth
sourced · official docs · 2026-10-28

Agent and you

Agent did

Read about 21 official Slack and Composio pages and the changelog, and cited each claim.
Probed slack.com/oauth/v2/authorize with an invalid client ID. It returns 200 with a script redirect.
Checked api.slack.com/apps. It loads and requires sign-in.
Drafted a channels:history reason, admin note, app description, and privacy checklist.

Agent can do

Write a manifest with scopes, events, redirect URL, and agent settings.
Write the OAuth flow, state check, token storage, and rotation.
Build an events-first reader and rate-limited history queue.
Draft listing copy, scope reasons, AI disclosures, and demo script.
Fill app settings in a browser after you sign in.

You must do

Sign in to Slack and create the app.
Decide on token rotation, which is permanent.
Get pilot customers and admins to install and approve.
Publish a privacy policy and support page.
Record the demo video and submit to the Marketplace.
Accept Slack's API terms, including no model training on Slack data.

Drafts

channels:history scope reason draft · scope justification

DRAFT, edit before use.

Scope: channels:history (bot token)

[App name] summarizes threads and drafts replies in Slack. When a user mentions @[App name] in a thread or clicks Summarize thread, we call conversations.replies for that thread and post a summary.

We read only public channels the bot was added to. We do not bulk read or export history.

We store only channel and thread IDs, not message text. Text goes to [model provider] only to summarize and is not used for training.

Without this scope, thread summaries do not work.

To test: install the app, invite @[App name] to a channel, start a thread, then mention @[App name] summarize.

Workspace admin approval note draft · other

DRAFT, edit before use.

Hi [admin name],

I requested approval for [App name]. It summarizes threads and drafts replies when mentioned.

Access:
- Public channel messages, only where the bot is added (channels:history)
- Mentions and direct messages to the app (app_mentions:read, im:history)
- Posting replies as the bot (chat:write)

It does not read other channels or export messages, and the vendor states it does not train AI models on our data. Privacy policy: [URL]. Security: [URL].

Approve it under Admin, Apps and workflows, App management settings. You can remove it there any time.

Thanks,
[Your name]

Marketplace descriptions draft · app description

DRAFT, edit before use.

Short (10 words or fewer): Summarize Slack threads and draft replies with AI.

Long: Mention @[App name] in a thread to get a summary of decisions and open questions, or a draft reply you can edit.

Add the bot to the channels you want. It reads only those, and only when asked.

AI notice: [model] generates summaries, which can be wrong. Slack data is not stored after the summary and never trains models.

DRAFT, edit before use.

- Slack data collected (message text, user IDs, channel IDs).
- How you use it.
- Retention. If you keep nothing, say so.
- Data received but unused.
- How users or admins request access, transfer, or deletion.
- A contact email or web form.
- The AI model, where it runs, and provider retention.
- No training on Slack data.
- A public support page, no account needed, replies within 2 business days.

Open questions

Do reduced history limits now apply to installs before May 29, 2025?
Slack says existing installs are unaffected with no end date, while unsourced reports cite March 3, 2026 or September 2, 2025.
To resolve: Ask Slack developer support, or test limits on an old unlisted install.
Does the 1 per minute limit apply to user tokens too?
The changelog describes the limit per app, not per token type.
To resolve: Ask Slack developer support, or test both token types.
How long does Marketplace review take in practice?
No developer report confirms Slack's stated timeline, and the submission page shows its estimate only after sign-in.
To resolve: Read your submission page estimate, or ask other Slack partners.
Is Composio's managed Slack app Marketplace-listed?
If not, managed connections get reduced history limits, and Composio's docs do not say.
To resolve: Ask Composio support, or search the Slack Marketplace.
Does a free pilot count as commercial distribution?
Slack ties the rate limit to commercial distribution but does not define where free or trial use falls.
To resolve: Ask Slack developer support before a large unlisted rollout.

Sources

Installing with OAuth official docs · 2026-10-28
Distributing your app official docs · 2026-10-28
Rate limit changes for non-Marketplace apps (FAQ) official forum or blog · 2026-10-28
Slack Marketplace app guidelines and requirements official policy · 2026-10-28
Slack Marketplace review guide official docs · 2026-10-28
Updated installation requirement for Slack Marketplace apps official forum or blog · 2026-10-28
Slack API Terms of Service official policy · 2026-10-28
Using token rotation official docs · 2026-10-28
PKCE is now generally available official forum or blog · 2026-10-28
Manage app approval for your workspace official docs · 2026-10-28
Developing for Enterprise orgs official docs · 2026-10-28
assistant:write scope official docs · 2026-10-28
channels:history scope official docs · 2026-10-28
Rate limits official docs · 2026-10-28
Managed auth composio docs · 2026-10-28
White-labeling authentication composio docs · 2026-10-28
Custom app vs managed app composio docs · 2026-10-28
Slack authorize endpoint probe probe · 2026-10-28
Slack API: Applications probe · 2026-10-28
Announcing the Slack MCP server and Real-time Search API official forum or blog · 2026-10-28
Slack just throttled your OpenClaw agent community · 2026-10-28
Optional scopes have landed official forum or blog · 2026-10-28
Slack adds a 1 per minute limit to some APIs for non-Marketplace apps (Japanese) community · 2026-10-28
Get to know the Slack app types (Trailhead) official docs · 2026-10-28
Developing agents official docs · 2026-10-28

Verification changes

Added a news report (e32) and a Salesforce Trailhead page (e33) as second sources for the history limit and for self-serve public distribution.
Tier-deciding claims need a second independent source. Both match Slack's own pages. 2026-10-28
Step s13 estimate changed from 2 to 12 weeks to up to about 12 weeks.
Slack states only upper limits: up to 10 business days, then up to 10 weeks. It gives no 2 week minimum. 2026-10-28
Requirement r9 and evidence e8 now say agent apps must not store Slack data, and list data tenancy as a disclosure.
The guidelines say agent apps may not store Slack data, which is stronger than should not. 2026-10-28
Step s8 no longer lists removing hard-coded tokens as a checklist item.
The distribution page names OAuth and SSL as preparation. It does not mention hard-coded tokens. 2026-10-28
Step s3 now names the Agents feature and asks you to check that assistant:write is present.
The assistant:write scope page does not say the feature adds the scope. Slack's agent docs now call the sidebar feature Agents and list the scope with it. 2026-10-28
Step s10 changed from many workspaces require approval to some workspaces do, and notes it is off by default.
Slack's help article says members can install apps without approval by default. How common approval is, is not stated. 2026-10-28
Token rotation blocker no longer names invalid_refresh_token as the error.
The token rotation page says reusing a refresh token fails but names no error code. 2026-10-28
Composio note now mentions credential import as a second way to move existing users.
Composio's white-labeling page offers re-authentication or credential import. 2026-10-28
Uncertainty about older installs now lists a second conflicting date (September 2, 2025) from a news report.
Two third-party sources give different end dates for the grace period. Slack's current changelog gives none. 2026-10-28