Connect Slack

Who this is for: admins who let workflows post to Slack, find people in Slack by email, or list channels and their members.

Before you start: you need the Manage connections permission in Liitora (Admin and Editor), and the Manage secrets permission to store the token. In Slack you need to be allowed to create and install apps in your workspace. Depending on your workspace’s settings, a Slack admin may have to approve the install.

Liitora talks to Slack as a Slack app that you create in your own workspace. The app has a bot token, which Liitora stores as a secret and sends only to slack.com. The app is not a person: it can do only what its scopes allow, and only in the channels it is a member of. You can remove the app at any time in Slack.

What the template sets for you

The Slack connection template fills in everything that is the same for every company. You choose only the secret that holds the bot token.

Setting	Value
Address	`https://slack.com/api`
Sign-in	The bot token, sent in the `Authorization` header
Other hosts it may call	none

Liitora accepts only bot tokens, which start with xoxb-. Test connection refuses a user token (xoxp-), an app-level token (xapp-) and any token with token rotation turned on (it starts with xoxe.), before it sends anything to Slack.

Create the Slack app

Go to api.slack.com/apps and create an app. Pick the workspace where Liitora should work, and give the app a name people will recognise, for example Liitora.
Open OAuth & Permissions.
Under Bot Token Scopes, add only the scopes for what your workflows do. See the table below.
Leave token rotation off. A rotating token stops working after 12 hours, and Slack can’t turn rotation off again once it is on. If it is already on, create a new app.
Select Install to Workspace and allow it.
Copy the bot token under OAuth Tokens. It starts with xoxb-.

If you add a scope later, install the app to the workspace again. The bot token stays the same.

Give the app only the scopes it needs

What the workflow does	Bot token scope
Post messages to channels the app is in, or to a person	`chat:write`
Post to any public channel without joining it first	`chat:write.public` (with `chat:write`)
Find a person by email	`users:read` and `users:read.email`
List public channels and their members	`channels:read`
List private channels the app is in, and their members	`groups:read`
List group messages or direct messages	`mpim:read` or `im:read`
Join a public channel	`channels:join`
Open a direct message with a person	`im:write`

Leave out everything else. Each scope widens what someone could do with the token if it leaked. The Slack actions each list the scopes they need, so you can add a scope when you start using an action.

Invite the app to channels

The app can post only in channels it is a member of. In each channel, type /invite followed by the app’s name. For a public channel, a workflow can also let the app join with slack.join-conversation. A private channel always needs an invite from someone in it.

Add the connection in Liitora

Open Secrets and add a secret of the kind API key, for example slack_bot. Paste the bot token as its value. See Add a secret.
Open Connections and select Add a connection.
Under Start from, pick Slack.
Type the Name, for example slack. Workflows use this name.
Pick the Environment. Add a Test setup too if you test workflows against a separate Slack workspace.
Under Secrets, type slack_bot for Bot token. If the secret doesn’t exist yet, select Ask for it so someone adds the value.
Select Save, then Test connection.

Your AI assistant can add the connection with the create_connection_from_template tool and ask for the token with request_secret. It never sees the token. See the MCP tools reference.

What Test connection checks

Test connection first checks that the secret holds a bot token, then asks Slack whether the token works (Slack’s auth.test). It reads no messages and no people. If it fails:

The test says	What to do
This is a rotating Slack token	Create a new Slack app with token rotation off, and store its bot token.
This is a Slack user token, or an app-level token	Store the app’s bot token instead. It starts with `xoxb-`.
Slack did not accept the bot token (`invalid_auth`)	Copy the bot token again from OAuth & Permissions. If your workspace allows calls only from certain IP addresses, allow Liitora’s addresses, see Allow Liitora through your firewall.
The bot token no longer works (`token_revoked` or `account_inactive`)	The app was removed or the token revoked. Install the app again and store the new bot token.

Where your data goes

Messages the app posts are stored where your Slack workspace keeps its data. On Slack plans with data residency, that is the region you chose, for example Frankfurt or Stockholm. Without it, Slack stores the data in the United States. Slack’s data residency does not cover member profiles or channel membership. All calls go to slack.com.

Slack answers a person lookup with their whole profile. The run log of a Slack connection records each request’s address and status, but not what was sent or answered. The address of a lookup by email contains the email address the workflow looked for. Bodies are never logged, so profiles and message texts stay out of it. A step’s output keeps only what the action returns, such as a user ID, for as long as your run data is kept. Slack’s API terms don’t allow using Slack data to train AI models.

When Slack slows you down

Slack lets an app post about one message per second to a channel, and limits each kind of request per minute. When a workflow goes over the limit, Slack answers 429 Too Many Requests with a wait time. Liitora waits that long and tries again, when the wait is up to a minute. If it keeps happening, the step fails and says so. Spread a large batch of messages over several channels or a longer time.

Sources

Written from Slack’s own documentation: