# Token types, revocation and token rotation

*Slack Developer Study Guide · Design for Security · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-developer/design-for-security/token-types-revocation-and-token-rotation*

Which token fits which job (bot xoxb, user xoxp, app-level xapp, app configuration tokens), what revokes a token or a whole installation, and how token rotation works: 12-hour xoxe. tokens, refreshing with grant_type=refresh_token, migrating with oauth.v2.exchange, and Bolt's automatic refresh.

- Certification: Salesforce Slack Developer
- Exam section: Design for Security
- Study guide: https://www.certifyforce.com/study-guide/slack-developer

**Official exam objective:**

> Request the appropriate tokens for your app's use case.

## What the exam expects

- Choose between bot, user, app-level and app configuration tokens from what the call must do and whose identity it uses.
- Default to the bot token and add a user token only when an action must come from a specific person.
- Predict what revokes a token: full uninstall, `auth.revoke`, deactivation of the authorizing user, `apps.uninstall` for the whole installation.
- Turn on token rotation: recognise `xoxe.` tokens and `expires_in: 43200`, refresh with `grant_type=refresh_token`, migrate existing tokens once with `oauth.v2.exchange`.
- Know that rotation cannot be turned off and that Bolt refreshes stored tokens for you.

Key terms: **bot token** (`xoxb-`, tied to the app, not a person); **user token** (`xoxp-`, the access of one member); **app-level token** (`xapp-`, the app across all organizations); **app configuration token** (per user and workspace, for the App Manifest APIs); **refresh token** (`xoxe-1-…`, single-use credential that buys a new access token).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Token prefixes | Bot `xoxb-`, user `xoxp-`, app-level `xapp-` | [Tokens](https://docs.slack.dev/authentication/tokens/) |
| Default lifetime | OAuth tokens do not expire without rotation | [Installing with OAuth](https://docs.slack.dev/authentication/installing-with-oauth/) |
| User deactivated | Tokens from the user who authenticated the app are revoked | [Installing with OAuth](https://docs.slack.dev/authentication/installing-with-oauth/) |
| `apps.uninstall` | Revokes every token of one installation; needs client ID and secret | [apps.uninstall](https://docs.slack.dev/reference/methods/apps.uninstall) |
| `auth.revoke` with rotation | Revokes one token; installation and events remain | [Using token rotation](https://docs.slack.dev/authentication/using-token-rotation/) |
| Rotated access token | `xoxe.` prefix, `expires_in` 43,200 seconds (12 hours) | [Using token rotation](https://docs.slack.dev/authentication/using-token-rotation/) |
| Turning rotation off | Not possible once on | [Tokens](https://docs.slack.dev/authentication/tokens/) |
| `oauth.v2.exchange` | Once per long-lived token | [Using token rotation](https://docs.slack.dev/authentication/using-token-rotation/) |
| Active token cap | 2 active tokens when refreshing repeatedly | [Using token rotation](https://docs.slack.dev/authentication/using-token-rotation/) |
| Config token | Expires 12 hours after generation; refresh with `tooling.tokens.rotate` | [tooling.tokens.rotate](https://docs.slack.dev/reference/methods/tooling.tokens.rotate) |
| Bolt support | JS 3.5, Python 1.7, Java 1.9 refresh automatically | [Using token rotation](https://docs.slack.dev/authentication/using-token-rotation/) |

## Check yourself

- Why is a bot token usually better than the installer's user token?
- When should an app call `apps.uninstall` instead of `auth.revoke`?
- Which token do the App Manifest APIs use, and how is it refreshed?
- Why must an app save the `refresh_token` from every refresh response?

## Sources

- [Tokens](https://docs.slack.dev/authentication/tokens/)
- [Using token rotation](https://docs.slack.dev/authentication/using-token-rotation/)
- [Installing via OAuth authorization code flow](https://docs.slack.dev/authentication/installing-with-oauth/)
- [oauth.v2.access method](https://docs.slack.dev/reference/methods/oauth.v2.access)
- [oauth.v2.exchange method](https://docs.slack.dev/reference/methods/oauth.v2.exchange)
- [tooling.tokens.rotate method](https://docs.slack.dev/reference/methods/tooling.tokens.rotate)
- [auth.revoke method](https://docs.slack.dev/reference/methods/auth.revoke)
- [apps.uninstall method](https://docs.slack.dev/reference/methods/apps.uninstall)
- [search:read scope](https://docs.slack.dev/reference/scopes/search.read)
- [Submission guidelines and requirements](https://docs.slack.dev/slack-marketplace/slack-marketplace-app-guidelines-and-requirements/)
- [App lifecycle & distribution](https://docs.slack.dev/app-management/distribution/)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Slack Developer pack (USD $19): https://www.certifyforce.com/practice-exams