Setting up Slack
Creating the internal Slack app that lets members connect their Slack accounts, the scopes it needs, and the security settings to turn on.
Create one Slack app for your workspace. Members then connect their own Slack accounts, and the assistant can search, read and post in Slack with each person's permissions. Connectors covers the Apps list this belongs to.
Before you start
Why you create the app yourself. Asteria Cloud reaches Slack through Slack's official MCP server, which Slack runs. Slack only lets two kinds of app use that server: apps published in the Slack Marketplace, and internal apps that belong to your own workspace. You create an internal app once, and it stays private to your workspace.
Who can do it. Anyone who can create apps in your Slack workspace can build the app. If your workspace requires app approval, a workspace owner or admin approves it before members can connect.
Keep the Asteria Cloud dialog open beside Slack. In the console, open Connectors, find Slack in the Apps list, and turn on its switch. The Set up Slack dialog opens with the two things Slack asks for: the Authorization callback URL and the list of OAuth scopes.
1. Create the app
- Open your Slack apps and choose Create New App, then From scratch.
- Enter a name members will recognise, such as "Asteria Cloud", pick your workspace, and choose Create App.
- If Slack asks which scopes the app needs, leave Bot scopes empty and add the scopes from step 4 on the User scopes tab. You can also skip this and add them later.
Do not use Manage Distribution. Distributing the app makes it a public, unlisted app, and Slack refuses those on its MCP server.
2. Turn on the MCP server
In the app's settings sidebar, open Agents and turn on Slack Model Context Protocol (MCP) Server. Without this switch, members can sign in but the assistant gets no Slack tools.
3. Add the callback URL
- Open OAuth & Permissions and find Redirect URLs.
- Choose Add New Redirect URL, paste the Authorization callback URL from the Asteria Cloud dialog, and choose Add.
- Choose Save URLs.
The URL must match exactly. If you use more than one Asteria Cloud environment, add each one's callback URL: Slack accepts several.
4. Add the user token scopes
Still in OAuth & Permissions, scroll to Scopes. Under User Token Scopes, not Bot Token Scopes, choose Add an OAuth Scope for each scope listed in the dialog's OAuth scopes field. They are user scopes because the assistant acts as the member who connected, never as a bot.
The dialog suggests every scope Slack's server supports. Each group unlocks a set of Slack tools:
| Scopes | What the assistant can do |
|---|---|
search:read.public, search:read.private, search:read.im, search:read.mpim, search:read.files, search:read.users | Search messages, files and people |
channels:history, groups:history, im:history, mpim:history | Read conversations and threads |
channels:read, groups:read, im:read, mpim:read | List conversations and their members |
chat:write | Send, schedule and draft messages |
channels:write, groups:write, im:write, mpim:write | Create conversations and manage their members |
canvases:read, canvases:write | Read, create and edit canvases |
files:read, files:write | Read and upload files |
lists:read, lists:write | Read and update Slack lists |
reactions:read, reactions:write | Read and add emoji reactions |
users:read, users:read.email, emoji:read | Look up people, their email addresses and custom emoji |
public, private, im and mpim stand for public channels, private channels, direct messages and group direct messages. The assistant never reaches more than the member's own Slack account can: a channel a member cannot open in Slack stays out of reach.
To grant less, remove a scope from both places: here in Slack, and from the OAuth scopes field in the Asteria Cloud dialog. Keep the two lists the same, so members are never asked for a scope the app does not have.
5. Turn on the security settings
Both settings are on the OAuth & Permissions page.
- Proof Key for Code Exchange (PKCE): choose Opt In. Asteria Cloud always uses PKCE when members connect, and this setting makes Slack check it.
- Token rotation: choose Opt In (it appears once a redirect URL is saved). Slack access tokens then expire after 12 hours, and Asteria Cloud renews them automatically, so members do not notice. Token rotation cannot be turned off once it is on.
6. Enter the credentials in Asteria Cloud
- In Slack, open Basic Information and find App Credentials.
- Copy the Client ID into the dialog's Client ID field.
- Choose Show next to Client Secret, then copy it into the dialog's Client secret field.
- Choose Save.
The Slack card is now on. Treat the client secret like a password: do not paste it into chat messages, tickets or screenshots.
Check the result
- Go to Profile then MCP Servers, and choose Connect next to Slack.
- Slack shows its consent screen, listing what the app may do. Choose Allow.
- In a chat, ask the assistant to list your Slack channels.
Before the assistant sends a message, or takes any other action Slack marks as a change, it shows an approval card, and nothing happens until you approve it. To decide which Slack tools are offered at all, open MCP servers and turn individual tools off.
If something goes wrong
Slack shows an error about the redirect URL. The URL saved in Redirect URLs does not match the one in the dialog. Copy it again from the dialog with Copy, and check for a missing or extra slash at the end.
Slack shows an error about scopes. Compare the dialog's OAuth scopes field with the app's User Token Scopes. Add any missing scope in Slack, or remove it from the dialog, then connect again.
Members connect, but the assistant has no Slack tools. The MCP server switch from step 2 is off. Turn it on, then have each member disconnect and connect again under Profile then MCP Servers.
Slack says the app is not approved. Your workspace requires app approval. A Slack workspace owner or admin approves it from the workspace's app management settings.
You change the scopes later. Every member has to connect again, because an existing Slack token cannot gain new scopes. Asteria Cloud asks each of them to reconnect.
You regenerate the client secret. Paste the new secret into the dialog. Members stay connected.