OAuth app readiness guide · Messaging

Getting your Slack app ready for real users

Tested in a real setup attemptChecked 2026-10-28slack.com

Verdict. You can have a Slack app installable in any workspace in under 10 minutes, with no review. But if your agent reads channel or thread history, that is throttled to 1 request a minute until Slack approves a Marketplace listing, which takes up to about 12 weeks after you reach 10 active workspaces.

At a glance

The answer in one screen

Ease of creation

Easy

About 5 minutes from a manifest. Measured in our test.

Ease of approval

Hard

Marketplace review, gated by 10 active workspaces.

Your hands-on time

10 min to 2 days

10 minutes to a working app. 1 to 2 days to prepare a Marketplace submission.

Waiting on the provider

None, or ~12 weeks

None to go live. Up to 10 business days plus up to 10 weeks for Marketplace review.

Do you need your own app yet?

Not to start. Composio has a managed Slack app.

Move to your own app when you need your brand on the consent screen, scopes beyond Composio's defaults, or your own rate limits instead of a shared quota.

Watch out: decisions you can't undo

The workspace that owns the app is permanent. Create the app in a workspace your company owns and will keep, never in a personal or trial workspace.
Turning distribution off later uninstalls you everywhere. Treat "Activate Public Distribution" as a one-way door once customers are on it.
A Marketplace listing locks the app. Request every scope you will need in the next 6 to 12 months before you submit, and keep a separate staging app.
Token rotation changes how you must store tokens. Decide before launch. If you turn it on, store the newest refresh token every time, or connections die with invalid_grant.

Agent an agent can do it You needs you Waiting on the provider

Prerequisites

What to have ready

To create and connect

A company-owned Slack workspace to own the app
A second workspace to test installs as a customer would
An HTTPS redirect URL. For Composio, the callback shown in your auth config
No hard-coded tokens or webhook URLs in your code (you attest to this)

For approval (can take days)

10 or more active workspaces (used in the last 28 days). The counter updates every 24 hours
Public homepage, privacy policy, support contact
Demo video: install, OAuth, setup, real use, uninstall
Test credentials and dummy data for your own product

App types

Which one is right for an agent product?

Single-workspace

The default after you create an app.

Who can install: Only the workspace it was built in
Review: None
Use it for: Building and testing

Recommended for agents

Distributed (unlisted)

After "Activate Public Distribution".

Who can install: Any workspace, through your install link
Review: None. Took effect instantly in our test.
Use it for: Beta and first customers

Marketplace (listed)

After Slack approves your submission.

Who can install: Anyone, and discoverable in Slack
Review: Yes, up to about 12 weeks
Use it for: Commercial product at scale

"Stay unlisted forever" is not a real option for a paid product.Slack's API terms say an app that is monetized, or connects to a paid product, needs Slack's authorization to be distributed commercially. For most apps that means the Marketplace; a partner agreement is the alternative. Apps built for one specific customer are exempt. Official docs

Recommended path for an agentBuild single-workspace, activate distribution for beta, and plan the Marketplace from day one if your agent reads messages. Slack's console now also offers an "AI agent" app template and an Agents settings page. Tested

Creation steps

Who does what, and how long it takes

YouSign in at api.slack.com/apps
1 min
The agent cannot sign in for you. Use the company-owned workspace (decision 1).
AgentCreate New App, choose "From a manifest"
1 min
The dialog also offers AI agent, Starter app and Blank app templates. A manifest is faster and reviewable.
AgentWrite the manifest
2 min
App name, bot user, scopes from section 4, the HTTPS redirect URL, and token_rotation_enabled set deliberately.
YouApprove "Create and Install"
10 sec
Creating and installing into your workspace is now a single step. Settings open at app.slack.com/app-settings.
YouCopy Client ID and Secret into Composio
2 min
Create a custom auth config and pass its ID for the slack toolkit. See section 11 on keeping the secret out of sight.
AgentClear the distribution checklist
1 min
With a manifest, 3 of 4 items pass automatically. The last is a checkbox confirming no hard-coded tokens.
YouApprove "Activate Public Distribution"
5 sec
No review. Took effect instantly. Without it, other workspaces get invalid_team_for_non_distributed_app.
YouTest install from a second workspace
10 min
Use an incognito window, as a new customer would.

Total in our test: about 5 minutes of agent work, one sign-in and two approvals.

Scopes

What each permission costs you

Agents usually use bot scopes (the app acts as itself, token starts xoxb-). User scopes act as the person (xoxp-) and are needed for things like search.

Agent use case	Scopes	What it costs you
Post messages	`chat:write`	No limit
List channels and people	`channels:readusers:read`	No limit
Read user emails	`users:read.email`	No limit
Read public channel history	`channels:history`	1 req/min, 15 messages per call until listed
Read private channels and DMs	`groups:historyim:history`	1 req/min, 15 messages per call until listed
Read threads	`channels:history`	Same throttle via `conversations.replies`

Minimal set: "Post updates" agentchat:writechannels:read

No review pressure at all.

Minimal set: "Summarize my channels" agentchat:writechannels:readchannels:history

Hits the history throttle immediately. See section 8.

Changing scopes later

While unlisted: add scopes freely in the manifest, but every existing workspace must reinstall to grant them. Existing connections do not upgrade on their own.
Once listed: a new scope needs resubmission with a demo video and a staging app.
In Composio: the scopes your auth config requests must match what the app allows, then users reconnect.

Approval and distribution

Review, cost and renewal

When you need it: To lift the history throttle, and for commercial distribution under Slack's terms. Cost: None from Slack. Renewal: None, but listed apps are locked (decision 3).

Gate

10 workspaces

Active in the last 28 days, before you can submit.

Step 1

Automated checks

Run in the console before submitting.

Step 2

Up to 10 business days

Preliminary review of listing and scopes. Resubmitting resets your place in the queue.

Step 3

Up to 10 weeks

Functional review: a reviewer installs and tests. Queue place is kept.

What you submit

Listing content and scope justifications
Security and compliance answers
Testing information and credentials
Demo video (install to uninstall)

Common rejection reasons

Broad or legacy scopes
Scopes for features that do not exist yet
Reviewer cannot install the app
Coded workflows (not eligible)

Slack will not speed up review for a launch date. Submit early.

Before approval: what works and what's capped

Build and test

Your own workspace only.

Limit: Other workspaces cannot install until distribution is active.

First customers

Any workspace can install, no review.

Limit: History and thread reads: 1 request/min, 15 messages per call.

Scale

Marketplace listing approved.

Limit: Standard rate-limit tiers. Changes need re-review.

What this means for an agentReading the last 200 messages of one busy channel takes about 14 minutes. Until you are listed, design around events (subscribe to new messages as they arrive) instead of polling history. Internal (customer-built) apps keep 50+ requests/min and 1,000 objects. Official docs

Data use and compliance

Rules that shape agent design

No LLM training on data from Slack APIs, for apps used outside the installing organization.
No bulk export of messages and files without a separate agreement.
Keep only what you need. Use, processing and retention must be the minimum the app needs to run.
No persistent copies or indexes of other organizations' data via the Data Access and Real-time Search APIs. Brief caching only.

Design impact"Sync the whole workspace into a vector database" is ruled out for a distributed app. Query live, cache briefly. Official docs

Common blockers

Symptom, cause, fix

Symptom	Cause	Fix
`invalid_team_for_non_distributed_app`	Distribution not activated	Manage Distribution, then Activate Public Distribution
`redirect_uri` mismatch	URL differs from the registered one, or is not HTTPS	Copy the exact callback from your Composio auth config
History calls return 15 messages and get rate limited	Unlisted app throttle	Use events, or go through Marketplace review
`invalid_grant` on refresh	Rotation on, an old refresh token was reused	Store the newest refresh token every time
Agent missing new permissions	Scopes added but workspaces did not reinstall	Ask users to reconnect; check granted scopes
Customer cannot install in their company workspace	Their admin requires app approval	Give customers an admin-approval note Not verified

Sources

Where every claim comes from

Claim	Source
App created and installed in one step; settings at app.slack.com	Tested in our setup
Distribution activates instantly with no review	Tested in our setup
Owning workspace cannot be changed	Tested in our setup
Deactivating distribution uninstalls everywhere	Tested in our setup
Token rotation off by default; PKCE opt-in	Tested in our setup
1 req/min and 15 objects for unlisted apps	Official docs
Review up to 10 business days + up to 10 weeks; 10 active workspaces	Official docs
No LLM training, no bulk export, minimal retention	Official docs
Manifest API returns credentials (level 1 handoff)	Not verified

All sources

Slack: Rate limit changes for non-Marketplace apps docs.slack.dev
Slack: Marketplace review guide docs.slack.dev
Slack: API Terms of Service slack.com
Slack: Using token rotation docs.slack.dev
Nango: invalid_team_for_non_distributed_app nango.dev
Composio: Managed vs custom auth docs.composio.dev