Slack connector setup

This page is the setup half — creating the OAuth app Slack needs in its own API console and getting its client id and secret into this deployment. Authorising a connection afterwards is the Authenticate control on the plugin sheet, which is what actually sends you to Slack.

1. Create the OAuth app in the Slack API console

1. Open the Slack API apps page and create a new app — this is your own app, not Botseon's.

2. Under OAuth & Permissions → Redirect URLs, add the redirect URL from docs/connectors/README.md — with the quickstart's default BOTSEON_PUBLIC_URL, that is:

   http://127.0.0.1:3000/api/oauth/slack/callback
   

3. Under Basic Information → App Credentials, the console shows you a Client ID and a Client Secret — copy both now.

2. Scopes

Request the narrowest set that covers the tools this connector exposes (F-PLUG-1: minimum scopes per capability, read and write requested separately), as user token scopes:

• channels:history — read messages in public channels the account can see; no writes.
• channels:read — list public channels and their metadata.
• groups:history — read messages in private channels the account is a member of.
• search:read — search messages the account can already see.
• users:read — look up member names and ids for labelling results.
• chat:write — post and edit messages as the connected account.
• reactions:write — add or remove a reaction on a message.

3. Enter the app

One command, with the client secret on standard input — there is no flag that takes it and no environment variable that holds it (see docs/connectors/README.md):

printf %s "$CLIENT_SECRET" | botseon oauth-app set \
  --org <organisation id> --slug slack \
  --client-id <the client ID from step 1> \
  --auth-url https://slack.com/oauth/v2/authorize \
  --token-url https://slack.com/api/oauth.v2.access \
  --configured-by <your user id>

Both URLs are read from Slack's own current documentation (Installing with OAuth), not invented here.

It stores the secret encrypted and prints the redirect URL from step 1 back, so you can check the two match. botseon oauth-app show --org <organisation id> --slug slack says whether an app is configured and under which client id; nothing prints the secret back.

Never put either value in a bot's description, a memory, or anywhere else a model reads as ordinary text.