Skip to main content
The Slack integration provides agents with access to the Slack Web API through Guild’s OAuth integration. Slack is dynamically resolved from its OpenAPI specification at runtime, so agents do not import a Slack-specific package.

Authentication

  • Type: OAuth 2.0
  • Token management: Slack tokens don’t expire — no refresh needed

Setup

OAuth scopes

Usage

Slack is dynamically resolved, so you do not import a Slack-specific package. Register the operations your agent needs with guildServiceTool() from the Guild Agents SDK, passing slack as the service name. Name each tool with the slack_ prefix to match the underlying operation — for example, the chat_post_message operation becomes the slack_chat_post_message tool.

Selecting specific tools

Agents perform better with fewer tools. Register only the operations your agent needs — add each one as its own guildServiceTool("slack", ...) entry:

API endpoints

Webhook events

Slack uses an app-scoped webhook model — a single webhook receives all events and Guild routes them to matching triggers. Events can be filtered to specific channels by setting channel_ids in the service configuration. Messages sent by the Guild bot itself are automatically excluded to prevent feedback loops.

Limitations

  • The bot must be invited to channels to receive message events (except app_mention, which works without an invite)
  • If the app is uninstalled from the workspace, credentials must be reconnected in Guild

How the Slack Integration Works

  Auth: OAuth 2.0, Bot Token Only  Guild uses Slack’s OAuth v2 flow. When a user connects Slack, they go through the standard redirect dance and Guild gets back a bot access token — a single token scoped to the installed workspace. Key things about this token:   - Never expires. Slack bot tokens are long-lived with no expiry. Guild stores it once and uses it forever — no refresh logic needed.   - No user token. Guild only gets a bot token, not a per-user token. All API calls are made as the bot, not as the user who installed it.   - One workspace per connection. A single Slack install = one team_id + one bot token. If you want multiple Slack workspaces in one Guild workspace, that’s not   supported.   - Bot user ID is captured at install time and stored alongside the token — this is used to filter out the bot’s own messages to prevent infinite loops.   Slack’s Architecture and What It Means Here   Slack’s API is split into two worlds:   1. Events (inbound) via webhooks   Slack pushes events to a single registered URL (/webhooks/slack). Guild validates the payload with HMAC-SHA256 (using X-Slack-Signature + X-Slack-Request-Timestamp), deduplicates by event_id, and routes to matching triggers.  Supported events: message, app_mention, reaction_added/removed, member_joined_channel, channel_created.  Limitations of the event model:   - The bot must be invited to a channel to receive message events there. app_mention is the exception — that works everywhere.   - If channel_ids is empty in the trigger config, all channels are processed (no default filtering). Easy to accidentally flood an agent with events.   - Events are app-scoped — there’s no per-user event subscription.   2. API calls (outbound) via Web API proxy  Agents make Slack API calls (post messages, list channels, etc.) through Guild’s HTTP proxy, which injects the bot token. The runtime exposes ~45 operations as agent tools (slack_chat_post_message, slack_conversations_list, etc.). Because everything uses the bot token, all messages come from the bot — you can’t post as a specific user. Other Noteworthy Limitations   - App uninstall = silent breakage. If someone uninstalls the Slack app from their workspace, the token goes invalid. There’s no revocation webhook handling — the user just has to reconnect.   - Payload scrubbing. Before webhooks reach agents, Guild strips URLs, thumbnails, avatars, and permalinks to reduce token usage. Agents won’t see file previews or image URLs from Slack.   - Signing secret is required. SLACK_WEBHOOK_SIGNING_SECRET must be configured or the webhook handler will error — no graceful degradation.