# Keeping an app to one workspace

*Slack Developer Study Guide · Distribute Your App · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-developer/distribute-your-app/keeping-an-app-to-one-workspace*

Why an internal app stays undistributed: one-click Install to Workspace with no OAuth code, data that cannot reach other workspaces, use cases the Slack Marketplace will not list, and the limits that still apply (user tokens need OAuth, requests still need verifying, rate limits still count).

- Certification: Salesforce Slack Developer
- Exam section: Distribute Your App
- Study guide: https://www.certifyforce.com/study-guide/slack-developer

**Official exam objective:**

> Examine why you would want to contain an app to a single workspace.

## What the exam expects

- Explain what an undistributed (single-workspace) app is and how it gets its token with Install to Workspace instead of an OAuth flow.
- Give the reasons to keep an app contained: no installs outside its workspace, simpler setup, and use cases the Slack Marketplace does not list.
- Recognise what staying internal does not change: full app capabilities, request verification, rate limits, and the need for OAuth when the app must act as individual users.
- Choose org-wide deployment, not public distribution, when an internal app must reach several workspaces of one Enterprise org.

Key terms: **undistributed app** (an app that exists on the single workspace it was created in and cannot be installed elsewhere); **associated workspace** (the workspace chosen when the app was created); **Install to Workspace** (the app-settings button that installs the app and shows its token); **public distribution** (the Manage Distribution switch that lets other workspaces install through OAuth); **org-wide deployment** (installing an app once on an Enterprise org and granting it to chosen workspaces).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default reach | A new app can be installed only in its associated workspace | [App lifecycle & distribution](https://docs.slack.dev/app-management/distribution/) |
| Install to Workspace | One-click install with no authorization code; token works only in that workspace | [App lifecycle & distribution](https://docs.slack.dev/app-management/distribution/) |
| Capabilities | Undistributed apps can use the full range of app capabilities | [App lifecycle & distribution](https://docs.slack.dev/app-management/distribution/) |
| User tokens | A single-workspace app acting for other users needs an OAuth 2.0 flow | [App lifecycle & distribution](https://docs.slack.dev/app-management/distribution/) |
| Install on another team | Fails with `invalid_team_for_non_distributed_app` | [Installing with OAuth](https://docs.slack.dev/authentication/installing-with-oauth/) |
| Never listed | Apps that export or back up message data, or only use Sign in with Slack | [Submission guidelines](https://docs.slack.dev/slack-marketplace/slack-marketplace-app-guidelines-and-requirements/) |
| Rate limits | Applied per method, per workspace, per app; no exemption for internal apps | [Rate limits](https://docs.slack.dev/apis/web-api/rate-limits) |
| Verification | Required over HTTP; skipped only over Socket Mode's pre-authenticated WebSocket | [Using Socket Mode](https://docs.slack.dev/apis/events-api/using-socket-mode) |
| Enterprise org reach | An undistributed app with org-wide support can install on any workspace in its org | [Installing with OAuth](https://docs.slack.dev/authentication/installing-with-oauth/) |
| Org-wide install | Added to no workspace until an Org Admin grants it | [Managing organization-ready apps](https://docs.slack.dev/enterprise-grid/organization-ready-apps) |

## Check yourself

- Why does an internal bot-only app not need any OAuth code?
- When does a single-workspace app still need an OAuth 2.0 flow?
- Which kinds of app are unsuitable for the Slack Marketplace, so that keeping them in the company's own workspace is the fit?
- Why is an undistributed app not exempt from rate limits?

## Sources

- [App lifecycle & distribution](https://docs.slack.dev/app-management/distribution/)
- [Creating an app from app settings](https://docs.slack.dev/app-management/quickstart-app-settings/)
- [Installing via OAuth authorization code flow](https://docs.slack.dev/authentication/installing-with-oauth/)
- [Submission guidelines and requirements](https://docs.slack.dev/slack-marketplace/slack-marketplace-app-guidelines-and-requirements/)
- [Using Socket Mode](https://docs.slack.dev/apis/events-api/using-socket-mode)
- [Managing organization-ready apps](https://docs.slack.dev/enterprise-grid/organization-ready-apps)
- [Rate limits](https://docs.slack.dev/apis/web-api/rate-limits)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the Slack Developer pack (USD $19): https://www.certifyforce.com/practice-exams