Secure Slack access for AI agents

Through Slack, agents can search messages, read channels and threads, and send or schedule messages on your team's behalf. Every call runs through your policies and is logged for audit.

Server URL: https://mcp.slack.com/mcp

Credential modes

Slack supports two modes:

Use SecureAuth's app – uses SecureAuth's pre-registered Slack app, so there is nothing to create in your workspace. Recommended for most installs.
Bring your own app – uses a Slack app your workspace owns. Choose this when you need your own branding on the consent screen, dedicated rate limits, or audit isolation inside your workspace.

See Credential modes for how the modes compare.

Before you begin

Administrator access to your Agent Authority workspace, to add the resource.
A Slack Workspace Owner. Option 2 needs one to create the app. Option 1 needs one only if your workspace restricts app installs, and needs no Slack-side work at all otherwise.

Option 1 stays in the Agent Authority console. Option 2 moves between two consoles: you copy a redirect URI in the Agent Authority console, create an app at api.slack.com/apps, then return to the console and paste the credentials. Keep both tabs open if you take option 2.

Setup

In the Agent Authority console, go to Resources → Add Resource and select Slack. Because Slack supports two credential modes, the console asks you to choose how to install Slack and shows a card for each mode. Click the card for the option you want, then follow that option below.

Either way, an Admin setup required dialog appears once the resource is added. Its View setup guide button links back to whichever option below matches the mode you picked.

Option 1: Use SecureAuth's app

Picking this option installs the resource immediately, with all tools and scopes pre-configured and no separate confirmation step.

That is the whole setup unless your workspace restricts app installs. Slack lets members add apps themselves by default. If a Workspace Owner has turned on app approval ("Only allow pre-approved apps"), SecureAuth AI Gateway, which is Slack's name for the pre-registered app, has to be approved before members can connect.

When a member first tries to connect, Slack sends an approval request to your Workspace Owners through Slackbot. An owner approves it once, and members can connect from then on.

Option 2: Bring your own app

Picking this option opens the credentials form. Step 1 starts there.

1. Copy the redirect URI

Copy the Redirect URI shown on the form, using the Copy button next to it. It includes your tenant's region, so copy it rather than typing it. It takes the form https://oauth.aisecurity.services.<region>.connect.secureauth.com/auth/callback.

Leave this page open. You come back to it in step 3.

2. Create a Slack app from a manifest

Go to api.slack.com/apps, click Create New App, and choose From an app manifest. Select your workspace, then paste the JSON below.

Replace <paste-redirect-uri> with the URI you copied in step 1, and <your-company> with your own branding. Leave everything else as it is: the scope list, pkce_enabled, and is_mcp_enabled are what the gateway expects.

{
  "display_information": {
    "name": "<your-company> Agent Authority",
    "description": "Agent Authority integration",
    "background_color": "#0b1326"
  },
  "features": {
    "bot_user": {
      "display_name": "<your-company>",
      "always_online": false
    }
  },
  "oauth_config": {
    "redirect_urls": ["<paste-redirect-uri>"],
    "scopes": {
      "user": [
        "search:read.public",
        "search:read.private",
        "search:read.mpim",
        "search:read.im",
        "search:read.files",
        "search:read.users",
        "chat:write",
        "channels:history",
        "groups:history",
        "mpim:history",
        "im:history",
        "canvases:read",
        "canvases:write",
        "reactions:read",
        "reactions:write",
        "users:read",
        "users:read.email"
      ],
      "bot": ["users:read"]
    },
    "pkce_enabled": false
  },
  "settings": {
    "org_deploy_enabled": false,
    "socket_mode_enabled": false,
    "token_rotation_enabled": false,
    "is_mcp_enabled": true
  }
}

Create the app. The manifest sets every scope listed under Required scopes, so there is nothing to select in Slack's scope picker.

Then go to Basic Information → App Credentials and copy the Client ID and Client Secret.

3. Finish in the console

Back on the Slack form in the Agent Authority console, paste the Client ID and Client Secret. Leave Token Endpoint Authentication on Auto-detect. Then click Add.

The resource is added with all tools and scopes pre-configured.

Verify the connection

The gateway syncs the available Slack tools automatically. To check the connection end to end, ask your agent to run a read-only request:

Show my Slack profile

If your Slack display name and profile details come back, the connection is working.

How users connect

Access is per user. Each additional user connects their own Slack account the first time their agent calls a Slack tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.

Each call uses the signed-in user's own token, so the channels and conversations that user can already see in Slack are the ones their agent can reach. The gateway does not widen access beyond that.

Available tools

Tool names are matched exactly by policy rules unless you use a wildcard, so copy them from here verbatim. Check the Available Tools card on the resource's Overview tab in the Agent Authority console for the authoritative list of what your install actually exposes.

Tool	Description
`slack_search_public`	Search public messages across channels
`slack_search_public_and_private`	Search public and private messages
`slack_search_channels`	Search for channels
`slack_search_users`	Search for users
`slack_send_message`	Send a message to a channel or user
`slack_send_message_draft`	Send a message draft
`slack_schedule_message`	Schedule a message for later delivery
`slack_read_channel`	Read messages from a channel
`slack_read_thread`	Read messages in a thread
`slack_read_user_profile`	Read a user's profile
`slack_create_canvas`	Create a new canvas
`slack_read_canvas`	Read a canvas
`slack_update_canvas`	Update an existing canvas
`slack_add_reaction`	Add an emoji reaction to a message

Required scopes

These are the scopes the gateway requests at sign-in, and they are the same in both credential modes:

search:read.public – search public channels
search:read.private – search private channels
search:read.mpim – search multi-person direct messages
search:read.im – search direct messages
search:read.files – search files
search:read.users – search users
chat:write – send messages
channels:history – read public channel history
groups:history – read private channel history
mpim:history – read multi-person direct message history
im:history – read direct message history
canvases:read – read canvases
canvases:write – create canvases
reactions:read – read message reactions
reactions:write – add and remove message reactions
users:read – read user profiles
users:read.email – read user email addresses

Neither option asks you to pick these one at a time. In option 1 they come with SecureAuth's app, and in option 2 the manifest in step 2 declares all of them at once. Each user sees the list on Slack's consent screen when they connect. If you edit the scopes in the manifest, the app no longer matches what the gateway requests and tools that rely on the missing scopes fail.

Policy examples

Rules are evaluated top to bottom and the first match wins; a call that matches no rule is denied. New rules are created at the top of the list, so create the rule you want evaluated last first.

Search and read, but no sending: allow slack_search_*, slack_read_*, then add a deny for slack_send_* and slack_schedule_message below those allows, or disable your organization's seeded Allow all rule so anything unmatched is denied. The allow rules alone block nothing: with Allow all in place, slack_send_message, slack_send_message_draft, and slack_schedule_message keep matching it. Removing Allow all is org-wide, so add the allows everything else needs first.
Only one agent may send: allow slack_send_* scoped to that agent, and add a deny for slack_send_* (unscoped) below it. A scoped allow does not exclude anyone: other agents simply fall through to the next matching rule, which is Allow all unless you deny or remove it.
Block scheduling messages entirely: add a deny rule for slack_schedule_message above any allow rules.

Next steps

Create a policy – start from the search-and-read pattern in Policy examples above.
Connections – manage the Slack accounts your users have linked.
Sandbox an agent to one Slack channel – a worked policy for this exact resource.

Secure Slack access for AI agents

On this page