Authentication & Setup | Slack

Two token types. This node authenticates with a Slack API bearer token — a bot token (xoxb-...) for almost every operation, or a user token (xoxp-...) for the two operations Slack restricts to user-level auth. There is no OAuth redirect flow inside the node itself — you generate the token once in your Slack App's settings and supply it as botToken (inline) or via a vault credentialID.

1. Create a Slack App

Go to api.slack.com/apps and click Create New App → From scratch.
Name the app and select the workspace you want to automate.
Open OAuth & Permissions in the left sidebar.
Under Scopes, add the Bot Token Scopes your workflow needs (see the table below — add only what you use).
If you plan to use message/search or user/updateProfile, also add the corresponding User Token Scopes.
Click Install to Workspace and approve the permissions.
Copy the Bot User OAuth Token (xoxb-...) — this is your botToken. If you added user scopes, also copy the User OAuth Token (xoxp-...).

2. Supply the Token to the Node

Either inline per node:

{
  "resource": "message",
  "operation": "send",
  "botToken": "xoxb-...",
  "channel": "#general",
  "text": "Hello from BizFirst.Ai"
}

Or via the credential vault, so the token is never stored in the workflow definition:

{
  "resource": "message",
  "operation": "send",
  "credentialID": 42,
  "channel": "#general",
  "text": "Hello from BizFirst.Ai"
}

When credentialID is set, ICredentialResolver.GetBearerTokenAsync resolves the stored secret and overwrites the inline botToken field before the API call is made — the vault always wins when both are present.

3. Required Scopes by Resource

Add only the Bot Token Scopes for the operations you actually use. These map to the underlying Slack Web API method each operation calls (see the resource pages for the exact method per operation).

Resource	Typical Bot Scopes	Notes
`message`	`chat:write`, `chat:write.customize`, `channels:read`	`chat:write.customize` only needed for `username`/`iconEmoji` overrides on `send`.
`channel`	`channels:read`, `channels:manage`, `groups:read`, `groups:write`, `im:read`, `im:write`, `mpim:read`	Which scopes you need depends on whether you target public channels, private channels, or DMs.
`file`	`files:write`, `files:read`	`files:write` for `upload`; `files:read` for `get`/`getMany`.
`reaction`	`reactions:write`, `reactions:read`	`reactions:read` only needed for `get`.
`user`	`users:read`, `users.profile:read`	`updateProfile` needs a user token instead — see below.
`userGroup`	`usergroups:read`, `usergroups:write`	`usergroups:write` for create/enable/disable/update/addUsers.

Two operations require a user token, not a bot token:

message/search (search.messages) — Slack does not expose message search to bots. Requires a user OAuth token with the search:read user scope.
user/updateProfile (users.profile.set) — updating a user's own profile fields (real name, status, etc.) requires a user OAuth token with the users.profile:write user scope. Bot tokens are rejected outright by Slack for this endpoint.

Supply the user token via the same botToken config key for search, or the dedicated userToken key for updateProfile.

4. Event Subscriptions (for future inbound features)

The current operation set is entirely outbound (the node calls Slack; Slack does not call back into the node). message/sendAndWait is designed to eventually pair with Slack's Events API (message replies/reactions triggering workflow resumption) but that inbound path is not yet wired — see Roadmap. No Event Subscriptions setup is required for any operation documented today.