Slack signs users in with the workspace account they already have open all day. It suits internal tools and B2B products whose users live in Slack.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find Slack, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Create the Slack app
- Open Slack API apps and select Create New App, then From scratch.
- Name it and pick a development workspace.
- Open OAuth & Permissions.
- Under Redirect URLs, add the redirect URI from Authdog and save.
- Under User Token Scopes, add
users.profile:read. - Install the app to your workspace.
- Open Basic Information > App Credentials and copy the Client ID and Client Secret.
Configure Authdog
| Field | Value |
|---|---|
| Client ID | From Basic Information |
| Client Secret | From Basic Information |
Save, then toggle the connection active.
What Slack returns
Authdog requests users.profile:read and reads the profile from https://slack.com/api/users.profile.get — display name, real name, avatar, and the email on the workspace profile.
Slack identity is workspace-scoped. The same person in two workspaces is two different users to Slack, and to Authdog. If your product is per-workspace, that is exactly what you want; if it is per-person, link on the email address instead.
Workspaces controlled by an admin may restrict app installation, in which case an admin has to approve your app before anyone in that workspace can sign in. Plan for that on any distribution beyond your own workspace.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select Continue with Slack and authorize.
- Confirm the user appears under Users with the workspace email attached.
Troubleshooting
| Symptom | Cause |
|---|---|
bad_redirect_uri |
The URI is missing from Redirect URLs |
invalid_scope |
The scope was added as a bot scope instead of a user scope |
missing_scope on the profile call |
The app was installed before users.profile:read was added — reinstall it |
| App requires approval | The target workspace restricts app installation |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| Enterprise SSO | Use the customer's identity provider for workforce sign-in |