Slack
The Slack integration monitors your workspace's members and guest accounts, bot users, installed applications, user groups, IDP-synced groups, and channel access — including externally shared channels.
Before starting
You will need:
- Admin access to your Slack workspace (to create and install a Slack app).
- For the optional app-inventory tier: a workspace admin willing to grant a user token.
- For the optional Enterprise Grid tier: org owner access to install an org-level app.
1. Create a Slack app
- Go to api.slack.com/apps and click Create New App → From scratch.
- Name it (e.g.
SlashID Sync) and select your workspace.
2. Grant bot token scopes
Under OAuth & Permissions → Scopes → Bot Token Scopes, add:
| Scope | Used for |
|---|---|
users:read | Members, guests, and bot users |
users:read.email | Email addresses (identity matching) |
usergroups:read | User groups and their members |
team:read | Workspace metadata |
channels:read | Public channels and membership |
groups:read | Private channels the bot is invited to |
3. Install the app and copy the bot token
- Under OAuth & Permissions, click Install to Workspace and authorize.
- Copy the Bot User OAuth Token (
xoxb-...).
The bot only sees private channels it has been invited to. Invite it to private channels you want covered, or use the Enterprise Grid tier for full visibility.
4. (Optional) Admin user token for app inventory
Without Enterprise Grid, Slack has no API that lists all installed apps. SlashID can
reconstruct the installed-app inventory from the workspace's integration activity log,
which requires a user token from a workspace admin with the legacy admin scope.
This is a personal, high-privilege credential: it acts as that admin and stops working if they are deactivated or lose admin rights. Prefer the Enterprise Grid tier when available. Without either optional token, SlashID still discovers apps through their bot users — most modern apps — just not apps installed with user tokens only.
5. (Optional) Enterprise Grid org admin token
On Enterprise Grid, install the app on the organization (not a single workspace) with
admin.teams:read, admin.users:read, and admin.apps:read scopes. This unlocks:
- The authoritative installed/restricted app inventory with granted scopes
- All workspaces in the org and per-workspace membership
- All channels org-wide (including private channels)
- IDP groups via the SCIM API
6. Create your Slack↔SlashID Integration
Go to the SlashID Console integrations page and create a Slack connection:
| SlashID Console field | Description | Example |
|---|---|---|
| Name of the connection | Arbitrary name for this connection | Slack Production |
| Authoritative status | Whether Slack identities are the primary source of truth when reconciling identities across providers | Primary or Secondary |
| Workspace URL | Your Slack workspace URL | https://yourcompany.slack.com |
| Bot token | The bot token from step 3 | xoxb-... |
| Admin user token | (Optional) The admin user token from step 4 | xoxp-... |
| Org admin token | (Optional) The Enterprise Grid org-level token from step 5 | xoxp-... |
What SlashID syncs
After the connection is created, SlashID periodically syncs:
- Always (bot token): members and guests, bot users, user groups, workspace metadata, channels with membership, and apps discovered via their bot users.
- With the admin user token: the full reconstructed app install inventory.
- With the org admin token: all workspaces, org-wide users, the authoritative app inventory with scopes, all channels, and IDP groups.
Troubleshooting
| Error / symptom | Cause | Fix |
|---|---|---|
invalid_auth | Token revoked, wrong token, or app uninstalled | Reinstall the app and update the token in the SlashID Console |
missing_scope | A required scope was not granted | The error names the missing scope — add it under Bot Token Scopes and reinstall the app |
not_allowed_token_type | A user token was entered as the bot token (or vice versa) | Bot token starts with xoxb-; the two optional tokens are user tokens (xoxp-) |
| Empty or partial app list | No optional token configured | Expected: only bot-user-derived apps appear. Add an optional token for fuller coverage |
SCIM 403 | Org token lacks SCIM provisioning access, or the plan is not Enterprise Grid | Verify Grid plan and that the org-level app install includes provisioning access |
| Private channels missing | Bot not invited and no org admin token | Invite the bot to the channels, or configure the Enterprise Grid tier |