Storing tokens, secrets and installations safely
Where each Slack credential belongs (environment variables in development, a secrets manager in production, a database keyed by workspace and user for customer tokens, the OS keychain for local tools), how a Bolt installation store saves and fetches workspace and org-wide installs, how to keep rotating tokens consistent across servers, and when to delete tokens.
Store and retrieve data and tokens safely.
~8 min read · 11 practice questions ·
What the exam expects
- Keep tokens, signing secrets and client secrets out of source code and repositories:
.envfiles for development, a secrets manager for production. - Keep the client secret on a server you control, never in desktop, mobile or client-side code; use the OS keychain for tokens on a user's machine.
- Implement a Bolt installation store (
storeInstallation,fetchInstallation,deleteInstallation) on a persistent database, keyed by team ID or, for org-wide installs, enterprise ID. - Store each token linked to its workspace and user, and look it up from the incoming request's IDs.
- With token rotation, persist the new refresh token every time and run one refresh job per installation into a shared store.
- Delete tokens on
tokens_revokedandapp_uninstalled, including backups; store only what you need and never show or log tokens.
Key terms: secrets manager (a service that injects secrets at build or run time, such as AWS Secrets Manager or HashiCorp Vault); installation store (Bolt's handlers that persist and look up installations); installation object (what Bolt passes to storeInstallation after an install); installQuery (the IDs Bolt passes to fetch or delete an installation); refresh token (single-use credential for getting a new access token).
Key facts
- Detail
.envfile, with.envin.gitignore
- Detail
- Secrets manager (GitHub Actions Secrets, AWS Secrets Manager, HashiCorp Vault)
- Detail
- Never in email, native apps, client-side JavaScript or public repos
- Detail
- System keychain; no plaintext tokens on disk
FileInstallationStore- Detail
- Development and testing only
- Detail
storeInstallation,fetchInstallation,deleteInstallation
- Detail
enterprise.idwhenisEnterpriseInstallis true;teamis undefined
- Detail
- Single-use; persist the new one from every refresh
- Detail
- Limit of 2 active tokens; oldest extra revoked
tokens_revoked payload- Detail
- User IDs per token type, not token strings
- Detail
tokens_revokedmay arrive afterapp_uninstalled
- Detail
- From all production systems and backups
- Why must a desktop app never contain the client secret?
- When does a Bolt installation store need the enterprise ID as its key?
- Why does reusing the refresh token saved at install fail on the second refresh?
- What does the `tokens_revoked` event contain?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams