Slack Developer Study Guide
The Certifyforce Slack Developer study guide covers the official Salesforce Slack Developer exam outline in 38 units across all 9 exam sections, one unit per exam-guide topic. The exam itself has 60 scored questions plus 5 unscored, a 90-minute limit and a 67% passing score, and its largest section is Design the Interactive Flow of Your App at 20%. Every unit is verified against official Salesforce documentation, cites its sources, and links to the practice questions that test it. Last updated October 21, 2026.
Focused on building secure, scalable Slack apps: app surfaces and Block Kit interfaces, the Web, Events, and admin APIs, Socket Mode, OAuth installation, scopes and tokens, Enterprise Grid support, Bolt and developer tools, and app distribution.
38 lessons · 9 exam sections · about 5 h of reading ·
Exam sections
Unlock the full guide
Every lesson's summary, exam expectations, key facts and self-check questions are free to read. The Slack Developer pack unlocks the self-check answers, core concepts, exam traps and worked scenarios, reading progress, personalized “read next”, and unlimited practice exams.
Apps in the Slack Platform
7% of the exam- Automation options: Workflow Builder, custom steps and webhooks~8 minHow to pick the lightest tool that meets an automation requirement: no-code Workflow Builder, a custom workflow step (Slack-hosted Deno Slack SDK or self-hosted Bolt), a one-way incoming webhook, or a full app built on the Events API and Web API.
- Choosing surfaces: App Home, modals and messages~8 minWhich surface fits which job: the per-user Home tab published with views.publish, modals that need a fresh trigger_id, and channel, DM or ephemeral messages chosen by who should see them, plus how to combine surfaces in one feature.
- App collaborators for shared app ownership~7 minWhen and how to give a Slack app more than one owner: what collaborator access covers (app settings, not code), how an owner recovers an app whose collaborators were all deactivated, the Slack CLI collaborator commands and shared apps.json, and rotating secrets after someone is removed.
Design the Interactive Flow of Your App
20% of the exam- Business workflows: approvals, alerts and custom step logic~8 minHow to turn a business process into a Slack app: spotting use cases, actionable approval and alert messages, onboarding on team_join, the shortcut-to-modal helpdesk pattern, and the custom workflow step lifecycle with complete(), fail() and declared outputs.
- Request URLs, 3-second acknowledgement and response_url~7 minWhere Slack sends interaction, slash command and event requests, how to acknowledge within 3 seconds and then respond, how response_url publishes, replaces and deletes messages, and how to design for payload IDs, Enterprise orgs and workspace differences.
- Entry points: slash commands, shortcuts, mentions and unfurls~7 minHow users start an app's workflow and what each entry point delivers: slash commands and their limits, global versus message shortcuts and their payload types, app_mention versus message.im, and link unfurling with link_shared and chat.unfurl, including composer previews.
- Message delivery options and the modal view stack~7 minWhen to post to a channel, a DM, an ephemeral message or a scheduled message, how to deep-link to App Home tabs, and how a modal's three-view stack works: views.open, push and update, private_metadata, view_closed, external_id and the response_action replies to a submission.
- Block Kit layouts, elements and input handling~7 minBuilding valid Block Kit layouts: block and field limits, header and modal view rules, buttons with action_id, style and confirm, static versus external select menus, reading view.state.values, returning validation errors, and updating a modal without losing input.
Design Your Workflows: Spotlight on Slack's APIs
13% of the exam- Choosing among Slack APIs by use case~7 minHow to pick the right Slack API from the requirement: the Web API to read and act, the Events API to be told, the Status API for Slack's own health, and the Admin, SCIM and Audit Logs APIs for organization administration.
- Web API calls, pagination and error handling~7 minHow to call Slack Web API methods correctly: RPC-style method URLs, token placement, JSON body rules, reading ok and error instead of the HTTP status, cursor pagination that stops only on an empty next_cursor, conversation types and scopes, and fixing common chat.postMessage errors.
- Events API subscriptions, payloads and retries~8 minHow Events API subscriptions depend on granted scopes and what the bot can see, how to read the event_callback wrapper (api_app_id, team_id, event.type), how to pick least-privilege events such as app_mention and handle app_home_opened, and how retries, redirects, failure limits and Delayed Events work.
- Socket Mode versus HTTP Request URLs~7 minWhen to receive events and interactive payloads over Socket Mode WebSockets or a public HTTP Request URL, and how Socket Mode works: the xapp app-level token with connections:write, apps.connections.open, envelope_id acknowledgements, up to ten connections, refresh disconnects, and the Marketplace HTTP requirement.
- Legacy APIs and terms versus current equivalents~7 minHow to recognise legacy Slack platform language and replace it: Conversations API instead of channels/groups/im/mpim methods, Events API or Socket Mode instead of RTM, granular bot scopes and xoxb tokens instead of custom bots, the umbrella bot scope and workspace tokens, plus as_user, ID prefixes, files.upload, Steps from Apps and exam-era product names.
- Rate limit tiers, Retry-After and event limits~7 minHow Slack rate limits work and how an app should react: Web API tiers per method, per workspace, per app in per-minute windows, HTTP 429 with Retry-After scoped to one method and workspace, about one message per second per channel, stricter limits without pagination, the 2025 conversations.history change for unlisted apps, and the 30,000-event Events API cap with app_rate_limited.
Design a Great User Experience
8% of the exam- Onboarding, account linking and Home tab design~8 minHow a Slack app should welcome installers and first-time users, link a Slack account to an external account without manual mapping, lay out a Home tab that works for every viewer and every workspace size, and make the Messages tab answer back.
- Notification etiquette, message cleanup and error replies~8 minHow often, when and where a Slack app should notify people, when output belongs in channel versus privately, how to condense or update finished interactive messages (including ephemeral ones), and how to name slash commands and write errors people can act on.
- Accessible copy, button labels and localization~8 minHow to write Block Kit content that works with screen readers and for every reader: emoji placement, meaning beyond colour, alt text, labelled inputs, specific button copy, and choosing channel or user locale when localizing, including what an app cannot localize.
Design for Security
19% of the exam- OAuth v2 installation flow and code exchange~8 minHow a Slack app gets its tokens: building the v2 authorize URL (scope, user_scope, redirect_uri, state, team), checking state, exchanging the ten-minute code with oauth.v2.access, reading the response, and the Bolt for JavaScript OAuth defaults.
- Bot and user scopes with least privilege~7 minPicking the least permissive scope for each task: the granular scopes behind common methods (join, read history, post, look up emails, react, slash commands), which scopes only user tokens can hold, why scopes accumulate across reinstalls, Sign in with Slack's separate flow, and how Marketplace review judges a scope list.
- Token types, revocation and token rotation~8 minWhich token fits which job (bot xoxb, user xoxp, app-level xapp, app configuration tokens), what revokes a token or a whole installation, and how token rotation works: 12-hour xoxe. tokens, refreshing with grant_type=refresh_token, migrating with oauth.v2.exchange, and Bolt's automatic refresh.
- Verifying Slack requests and securing transport~8 minHow an app proves inbound requests came from Slack (signing secret HMAC over v0:timestamp:raw body, five-minute replay window, mutual TLS, Bolt's built-in check) and how it protects outbound traffic and tokens: url_verification over valid TLS, Socket Mode, the Restrict API Token Usage IP list, tokens in headers, HTTPS redirect URLs and unfurl controls against prompt-injection exfiltration.
- Storing tokens, secrets and installations safely~8 minWhere each Slack credential belongs (environment variables in development, a secrets manager in production, a database keyed by workspace and user for customer tokens, the OS keychain for local tools), how a Bolt installation store saves and fetches workspace and org-wide installs, how to keep rotating tokens consistent across servers, and when to delete tokens.
Design for Scale
9% of the exam- Org-ready apps and global IDs in Enterprise orgs~8 minHow an app becomes org-ready and is installed once by an Org Admin, how it tracks granted workspaces and passes team_id, and how it handles global user IDs, enterprise_id, shared-channel events and workspace migration.
- Developer sandboxes for Enterprise org testing~8 minWhat a Slack developer sandbox is: a free Enterprise org environment from the Slack Developer Program, basic versus full-featured eligibility, the six-month lifespan with extension, archive and grace period, and the user, Slack Connect, distribution and Discovery API limits to plan around.
- Supporting Slack Connect channels in your app~8 minHow to decide which app features work in Slack Connect channels: detecting external shares with is_ext_shared, what external members can and cannot trigger, authorized_users and sensitive-data checks, changing channel IDs, check_file_info, and the inviteShared and acceptSharedInvite API methods.
Tools
5% of the exam- Slack CLI quickstart, samples and developer support~7 minHow to get a first Bolt app running with the Slack CLI quickstart, which official sample or tutorial fits a requirement, where to report framework defects, and how to spot an outdated external tutorial built on end-of-life packages.
- Choosing Bolt or the Slack SDKs~7 minWhat the Bolt frameworks for Java, JavaScript and Python give an app out of the box, when a plain Slack SDK client such as the Python WebClient is the lighter choice, and why every Bolt listener acknowledges before doing slow work.
- Prototyping layouts with Block Kit Builder~6 minWhat Block Kit Builder is for (choosing, arranging and previewing blocks, then copying the JSON), how to preview surfaces, clients and themes, how Send to Slack gets stakeholder feedback before code exists, and how to hand the builder's payload to chat.postMessage correctly.
- Slack Developer Tools for in-Slack debugging~7 minWhat the Slack Developer Tools (SDT) app does inside Slack (inspect a message's Block Kit JSON, look up Web API methods, test an incoming webhook, find IDs and platform status), who can use it, and which jobs belong to the Slack CLI or Block Kit Builder instead.
APIs for Managing Your Slack
12% of the exam- Admin API methods for org automation~8 minWhen an app built on the admin.* Web API methods should replace clicks in the admin dashboard: app approvals with app_requested, invite requests, session resets, workspace invites, channel placement, IdP group allowlists and defaults, and the analytics file.
- SCIM API user and group provisioning~8 minHow the SCIM API creates, updates, deactivates and reactivates Slack users and manages groups: v1.1 versus v2.0, filters and paging, what DELETE and PUT really do, provisioning limits, per-user locking with 429 Retry-After, and org-wide SCIM with IdP groups in an Enterprise org.
- Audit Logs API queries and events~8 minHow to monitor an Enterprise org with the read-only Audit Logs API: the three GET endpoints, the actor-action-entity-context shape of every event, combining filters, newest-first results with cursor pagination, and the org-wide Tier 3 rate limit that all apps share.
- Discovery API for eDiscovery and DLP~7 minWhen the Discovery API is the answer: permitted security and compliance uses only, approved eDiscovery partners that archive read-only versus DLP partners that quarantine or remove, edits and deletions preserved by retention and legal holds, and the content types it exports.
- Org roles and tokens for management APIs~8 minWhich Slack role must install or enable each management API and which token it yields: Org Admin or Owner for admin.* scopes, Org Owner only for the SCIM app and Audit Logs, Primary Org Owner or Org Owner for Discovery, plus org-level installs, xoxp user tokens and the same-or-fewer-permissions rule.
Distribute Your App
7% of the exam- Keeping an app to one workspace~8 minWhy an internal app stays undistributed: one-click Install to Workspace with no OAuth code, data that cannot reach other workspaces, use cases the Slack Marketplace will not list, and the limits that still apply (user tokens need OAuth, requests still need verifying, rate limits still count).
- Public distribution and Add to Slack installs~8 minHow to share an app with other workspaces: the Manage Distribution checklist (OAuth flow, HTTPS URLs), Activate Public Distribution and the Add to Slack button and shareable URL it unlocks, admin approval and minimal scopes, and what deactivating distribution or losing the installer does to existing installs.
- Single-workspace, distributed and Marketplace apps compared~8 minThe three distribution models side by side: undistributed apps in one workspace, unlisted distributed apps installed through OAuth, and Slack Marketplace apps that passed Slack's review; which apps can never be listed, what admin Marketplace-only policies mean, and how token storage changes when an app goes multi-workspace.
- Slack Marketplace submission and review~8 minHow an app gets into the Slack Marketplace (the exam's Slack Directory): the 10-active-workspace prerequisite, what to hand reviewers, the preliminary and functional review stages, listing assets and pages, scope rules, and how to change a published app without breaking installs.
Common questions about the Slack Developer study guide
Is the Slack Developer study guide free?
Partly. Every unit's summary and its "What the exam expects", "Key facts" and "Check yourself" sections are free to read without an account. The "Core concepts", "Exam traps" and "Worked scenario" sections, reading progress and unlimited timed mock exams come with the Slack Developer pack (USD $19).
How current is the Slack Developer study guide?
It is written to the current official Salesforce Slack Developer exam outline, and each unit is checked against Salesforce documentation before it is published. The most recent update was October 21, 2026, and every unit shows its own last-updated date.
How does the study guide map to the official Slack Developer exam guide?
There is one unit per topic in the official exam guide, grouped under its 9 weighted sections: Apps in the Slack Platform (7%), Design the Interactive Flow of Your App (20%), Design Your Workflows: Spotlight on Slack's APIs (13%), Design a Great User Experience (8%), Design for Security (19%), Design for Scale (9%), Tools (5%), APIs for Managing Your Slack (12%), Distribute Your App (7%). Each unit quotes the exam objective it covers word for word.
How do the practice questions link to the study guide?
Each unit lists the reviewed practice questions that test it (300 questions are linked across the guide), so you can read a topic and practice it in one click. After a practice exam, every missed question links back to the unit that teaches it.