Slack

PwrAgent’s Slack adapter uses Socket Mode — PwrAgent dials out to Slack, no public Request URL is needed.

What you need to get started

A Slack app you’ve created in your workspace.
A bot token (xoxb-…) from that app.
An app-level token (xapp-…) with the connections:write scope for Socket Mode.

You don’t need a public webhook URL. You don’t need to configure a Request URL on Event Subscriptions or Interactivity.

Step by step

The most common reason setup fails is doing these steps in the wrong order — Slack steers you toward the Request-URL flow if Event Subscriptions are configured before Socket Mode. Follow the order below.

Create the Slack app. Go to api.slack.com/apps, Create New App, pick From scratch, name it (e.g. PwrAgent), pick the target workspace.
Enable Socket Mode first. In your app, go to Socket Mode and turn on Enable Socket Mode. Do this before opening Event Subscriptions or Interactivity & Shortcuts. If you’ve already configured those, Slack may force a Request URL; turn off the Request URL requirement after enabling Socket Mode.
Create the app-level token. Still in Socket Mode, create an app-level token with the connections:write scope. Slack returns a token starting with xapp-. Copy it.
Add the bot user. In OAuth & Permissions, add the bot scopes (see “Minimum scopes” below). Then install the app to the workspace. Slack returns a bot token starting with xoxb-. Copy it.
Configure Event Subscriptions. In Event Subscriptions, turn on events, subscribe the bot to the message events you need:
- message.channels — public channels
- message.groups — private channels
- message.im — DMs
- message.mpim — multi-person DMs
- app_mention — bot mentions
With Socket Mode on, Slack should not require a Request URL.
Configure Interactivity & Shortcuts. Enable interactivity for Block Kit button clicks. Again, no public Request URL is needed.
Open Settings → Messaging → Slack in PwrAgent.
Paste the bot token and the app-level token. Click Save.
Click Test. PwrAgent calls auth.test to verify the bot token.
Enable Slack with the toggle at the top of the panel.
DM or @mention the bot. With the user allowlist empty, Settings → Messaging → Activity logs your Slack user ID for the rejected attempt. Copy the U… value into the authorized list.
Try /resume or @PwrAgent resume.

Minimum bot scopes

chat:write — outbound messages and updates.
channels:history, groups:history, im:history, mpim:history — for the conversation types you want the bot to operate in. These scopes also let PwrAgent fetch a thread’s root message so binding chips can show #channel/root message instead of a generic #channel/Thread label.
channels:read, groups:read, im:read, mpim:read — optional, recommended for friendlier channel-name labels in chips.
files:read, files:write — inbound and outbound file handling.
users:read — optional but recommended; lets PwrAgent label DM bindings and Activity entries with the person’s profile name instead of their U… ID.
commands — only if you’re registering Slack slash commands.

Settings → Messaging → Slack panel — **Settings → Messaging → Slack**. **Test** confirms PwrAgent can reach the Slack API; **Authorized User IDs** is populated by the Pairing flow. (Captured before the per-surface Authorization group landed; the panel now carries the DM / team / channel gates documented below.)

Pairing

For the captured walkthrough of the pairing flow (generate → send code → approve), and the troubleshooting Activity screen that shows blocked inbound messages, see Messaging → Pairing. Same flow on every supported platform; the screenshots there happen to be Telegram.

On Slack, the pairing token field sits under the panel’s Authorization group and is bucket-aware: pair yourself as a user first, then Channel pairing — posting a pairing code in the channel you want to open — is the recommended way to add a channel to the authorized list without hunting for a C… ID.

Authorization model

Slack access is per-surface, and fresh configs default locked-down — enabling the adapter authorizes nobody and opens no channels. The gates, in the order the panel presents them:

Gate	What it controls
DM access	Who may DM the bot 1:1. Authorized users only is the safe default; the team and channel gates below don’t apply to DMs.
Group DM access	Whether the bot participates in multi-person DMs. Closed by default. When opened to authorized users, the bot replies in a group DM only when @mentioned.
Team access default	Whether channel messages must come from an Authorized Team (`T…` IDs). Mainly restricts Slack Connect / shared-channel traffic.
Channel access default	Whether messages must come from an Authorized Channel (`C…`/`G…`/`D…` IDs). Require listed channels is the safe default; each authorized channel row can override the response mode for just that channel.
Channel user access	Which senders inside an authorized channel the bot responds to — authorized users only by default.
Channel response default	How the bot responds once a channel message passes the gates (e.g. reply only when @mentioned).

Group-DM detection is identity-based, not name-based — a channel renamed to look like a group DM doesn’t slip through a different gate.

Settings reference

Required (above the Test button)

Setting	What it does
Enabled	Top-of-panel toggle. When off, the adapter doesn’t start.
Bot Token	`xoxb-…` from the OAuth & Permissions tab. Stored in the system keychain.
App Token	`xapp-…` from the Socket Mode tab. Required for the WebSocket connection. Stored in the system keychain.
Signing Secret (Optional)	Optional in Socket Mode — PwrAgent uses it as a stable local secret for Block Kit button payload validation, so buttons rendered before an adapter restart still validate after it. Get it from Basic Information → App Credentials.
Authorized User IDs	`U…` (or enterprise `W…`) IDs that count as authorized users. Pairing or activity-log discovery populates this.

Authorization

The per-surface gates documented under Authorization model above: DM access, Group DM access, Team access default (+ Authorized Team IDs), Channel access default (+ Authorized Channels), Channel user access, Channel response default.

Optional / advanced

Setting	Default	What it does	When to change
Inbound Mode	Socket Mode	Socket Mode keeps Slack callbacks on an outbound WebSocket; Events API is reserved for a future HTTP callback path.	Leave on Socket Mode.
Register slash commands	Off	Registers Slack slash commands for the app.	Leave off unless your Slack app is configured for PwrAgent slash commands; `@PwrAgent resume` works regardless.
Workspace URL	(blank)	Display-only metadata for binding chips and Activity entries.	Set to your workspace’s URL (e.g. `https://example.slack.com`).
Streaming Responses (Advanced)	Off	Bot edits its reply message in place as the response streams in.	Leave off. See Streaming responses.
Working Updates	Show Some	How much in-progress work is bridged to the conversation.	See Working Updates; the status card overrides per-binding.
Image Upload Profile	medium	Quality used when forwarding inbound images to the model.	`low`/`high`/`actual` per your bandwidth / fidelity tradeoff.

Slack-specific notes

One Slack app per desktop bot identity. If twenty people each run their own PwrAgent, the safest deployment is twenty Slack apps. Sharing one app token / bot token across many desktop instances means every instance connects as the same bot and may double-handle events. There is no current sharding story for that case.
DM edits and channel edits are more permissive than Telegram, but chat.postMessage has its own special rate limit. Don’t treat Slack as “free edits.”
Slash commands are currently reserved. PwrAgent registers Slack slash commands only when you flip the explicit toggle; the recommended invocation path is @PwrAgent resume text-mention, which works on every Slack workspace without per-app configuration.