Token types, revocation and token rotation
Which token fits which job (bot xoxb, user xoxp, app-level xapp, app configuration tokens), what revokes a token or a whole installation, and how token rotation works: 12-hour xoxe. tokens, refreshing with grant_type=refresh_token, migrating with oauth.v2.exchange, and Bolt's automatic refresh.
Request the appropriate tokens for your app's use case.
~8 min read · 10 practice questions ·
What the exam expects
- Choose between bot, user, app-level and app configuration tokens from what the call must do and whose identity it uses.
- Default to the bot token and add a user token only when an action must come from a specific person.
- Predict what revokes a token: full uninstall,
auth.revoke, deactivation of the authorizing user,apps.uninstallfor the whole installation. - Turn on token rotation: recognise
xoxe.tokens andexpires_in: 43200, refresh withgrant_type=refresh_token, migrate existing tokens once withoauth.v2.exchange. - Know that rotation cannot be turned off and that Bolt refreshes stored tokens for you.
Key terms: bot token (xoxb-, tied to the app, not a person); user token (xoxp-, the access of one member); app-level token (xapp-, the app across all organizations); app configuration token (per user and workspace, for the App Manifest APIs); refresh token (xoxe-1-…, single-use credential that buys a new access token).
Key facts
- Detail
- Bot
xoxb-, userxoxp-, app-levelxapp-
- Detail
- OAuth tokens do not expire without rotation
- Detail
- Tokens from the user who authenticated the app are revoked
apps.uninstall- Detail
- Revokes every token of one installation; needs client ID and secret
auth.revoke with rotation- Detail
- Revokes one token; installation and events remain
- Detail
xoxe.prefix,expires_in43,200 seconds (12 hours)
- Detail
- Not possible once on
oauth.v2.exchange- Detail
- Once per long-lived token
- Detail
- 2 active tokens when refreshing repeatedly
- Detail
- Expires 12 hours after generation; refresh with
tooling.tokens.rotate
- Detail
- JS 3.5, Python 1.7, Java 1.9 refresh automatically
- Why is a bot token usually better than the installer's user token?
- When should an app call `apps.uninstall` instead of `auth.revoke`?
- Which token do the App Manifest APIs use, and how is it refreshed?
- Why must an app save the `refresh_token` from every refresh response?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams