Slack app development cheat sheet

Tokens

• xoxb- bot token: acts as the app's bot user
• xoxp- user token: acts on behalf of a person
• xapp- app-level token: Socket Mode (connections:write)
• Signing secret: verifies HTTP requests from Slack

Request signing

• Base string: v0:{X-Slack-Request-Timestamp}:{raw body}
• HMAC-SHA256 with the signing secret, compare with X-Slack-Signature (v0=...)
• Reject timestamps older than 5 minutes
• Retries carry X-Slack-Retry-Num and X-Slack-Retry-Reason

Signature generator

Delivery modes

• Events API over HTTP: public Request URL, url_verification challenge on setup
• Socket Mode: WebSocket from your app, no public URL; not allowed for Marketplace apps
• Acknowledge events, commands and interactions within 3 seconds
• response_url lets you reply to a command or interaction later

mrkdwn

• *bold* _italic_ ~strike~ `code` ```block```
• <https://example.com|text> links
• <@U123>, <#C123>, <!here>, <!channel>
• Escape &, < and > as &amp; &lt; &gt;

Block Kit builder

Common bot scopes

• chat:write post messages
• commands slash commands
• app_mentions:read @mentions of the app
• channels:history, im:history read messages
• users:read, reactions:write, files:write

Common errors

• not_in_channel invite the bot or use chat:write.public
• channel_not_found wrong ID or no access
• missing_scope add the scope and reinstall
• invalid_blocks check limits and field types
• ratelimited / HTTP 429 honor Retry-After