Dev Tools · 1h ago
Slack Bot vs User Tokens: A Guide to Least Privilege Scopes
Slack apps use two OAuth token types: bot tokens (xoxb-) for bot actions and user tokens (xoxp-) for human-like operations. Bot tokens are preferred for durability and only see channels they're invited to, while user tokens are needed for workspace search, compliance exports, or posting as a user. The article provides concrete scope examples to help developers avoid over-requesting permissions and marketplace rejection.
Meridian48 take
This is a practical, security-conscious guide that every Slack app developer should bookmark, but its narrow focus means it's mostly relevant to teams building or reviewing Slack integrations.
Read the full reporting
Slack Bot Token vs User Token Scopes: Least Privilege in Practice →
DEV Community
slack-apioauth-scopes