OAuth v2 installation flow and code exchange
How a Slack app gets its tokens: building the v2 authorize URL (scope, user_scope, redirect_uri, state, team), checking state, exchanging the ten-minute code with oauth.v2.access, reading the response, and the Bolt for JavaScript OAuth defaults.
Implement the OAuth installation flow.
~8 min read · 13 practice questions ·
What the exam expects
- Name the three steps an app handles to get a token: request scopes, wait for approval at the Redirect URL, exchange the code.
- Build an authorize URL that puts bot scopes in
scopeand user scopes inuser_scope, and send aredirect_urithat matches on the exchange. - Reject a callback whose
statedoes not match, and exchange the code within its ten-minute life using the client ID and secret. - Read the
oauth.v2.accessresponse to find the bot token, the installer's user token and scopes, and where the app was actually installed. - Configure Bolt for JavaScript OAuth:
clientId,clientSecret,stateSecret,scopes,installerOptionsand the default routes.
Key terms: authorize URL (https://slack.com/oauth/v2/authorize, where the user approves scopes); Redirect URL (the HTTPS callback Slack returns the user to with a code); temporary authorization code (the one-time code exchanged for tokens); state (a per-session value the app sends and checks to detect forged callbacks); authed_user (the response object holding the installer's user token).
Key facts
- Detail
https://slack.com/oauth/v2/authorize; bot scopes inscope, user scopes inuser_scope
- Detail
- The temporary authorization code expires after ten minutes
state mismatch- Detail
- Treat the authorization as a forgery
- Detail
- Prefer HTTP Basic auth over
client_id/client_secretparameters
redirect_uri on exchange- Detail
- Required if it was sent on authorize; mismatch returns
bad_redirect_uri
- Detail
- HTTPS only, no
#anchor;redirect_urimay be a subdirectory
- Detail
authed_user.scope; top-levelscopeis the bot token's
- Detail
team.id, orenterprise.idwithis_enterprise_install
unapproved_scope- Detail
- Published app requests a scope not yet approved in review
- Detail
incoming-webhookscope; readincoming_webhook.urlfrom the response
- Detail
/slack/installand/slack/oauth_redirect
directInstall- Detail
- Default
false;trueredirects to the authorize URL without rendering a page
- Why does Slack make the app exchange a code instead of sending the token to the Redirect URL?
- When must `oauth.v2.access` include `redirect_uri`?
- Which response field lists the user scopes the installer granted?
- Why should a Bolt app keep `stateVerification` at its default?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams