Keeping an app to one workspace
Why an internal app stays undistributed: one-click Install to Workspace with no OAuth code, data that cannot reach other workspaces, use cases the Slack Marketplace will not list, and the limits that still apply (user tokens need OAuth, requests still need verifying, rate limits still count).
Examine why you would want to contain an app to a single workspace.
~8 min read · 5 practice questions ·
What the exam expects
- Explain what an undistributed (single-workspace) app is and how it gets its token with Install to Workspace instead of an OAuth flow.
- Give the reasons to keep an app contained: no installs outside its workspace, simpler setup, and use cases the Slack Marketplace does not list.
- Recognise what staying internal does not change: full app capabilities, request verification, rate limits, and the need for OAuth when the app must act as individual users.
- Choose org-wide deployment, not public distribution, when an internal app must reach several workspaces of one Enterprise org.
Key terms: undistributed app (an app that exists on the single workspace it was created in and cannot be installed elsewhere); associated workspace (the workspace chosen when the app was created); Install to Workspace (the app-settings button that installs the app and shows its token); public distribution (the Manage Distribution switch that lets other workspaces install through OAuth); org-wide deployment (installing an app once on an Enterprise org and granting it to chosen workspaces).
Key facts
- Detail
- A new app can be installed only in its associated workspace
- Detail
- One-click install with no authorization code; token works only in that workspace
- Detail
- Undistributed apps can use the full range of app capabilities
- Detail
- A single-workspace app acting for other users needs an OAuth 2.0 flow
- Detail
- Fails with
invalid_team_for_non_distributed_app
- Detail
- Apps that export or back up message data, or only use Sign in with Slack
- Detail
- Applied per method, per workspace, per app; no exemption for internal apps
- Detail
- Required over HTTP; skipped only over Socket Mode's pre-authenticated WebSocket
- Detail
- An undistributed app with org-wide support can install on any workspace in its org
- Detail
- Added to no workspace until an Org Admin grants it
Sources for this section (6)
- App lifecycle & distributiondocs.slack.dev (opens in a new tab)
- Installing with OAuthdocs.slack.dev (opens in a new tab)
- Submission guidelinesdocs.slack.dev (opens in a new tab)
- Rate limitsdocs.slack.dev (opens in a new tab)
- Using Socket Modedocs.slack.dev (opens in a new tab)
- Managing organization-ready appsdocs.slack.dev (opens in a new tab)
- Why does an internal bot-only app not need any OAuth code?
- When does a single-workspace app still need an OAuth 2.0 flow?
- Which kinds of app are unsuitable for the Slack Marketplace, so that keeping them in the company's own workspace is the fit?
- Why is an undistributed app not exempt from rate limits?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (5 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams