Integrating Slack with Frontegg allows your application to read user profiles, browse channels and conversations, post, update, and delete messages, read threads, create and manage channels and their membership, open direct messages, manage files, and search a Slack workspace — all through Frontegg's integration layer using Slack OAuth v2 (user tokens).
Prerequisites
Prerequisites
- A Slack workspace where you have permission to create and install apps
- Access to the Slack API console
Sign in to the Slack API console with an account that belongs to the workspace where you want to install the app. Click Create an App at the top of the page.
In the Create an app dialog, choose From scratch to configure the app manually through the UI.
Enter an App Name (for example, Frontegg Integration) and pick the Slack workspace you want to develop the app in. Click Create App.
Workspace is permanent
Workspace is permanent
You can't change the app's development workspace after creation. Pick the workspace whose data you want Frontegg to access.
After creation, you are taken to the app's Basic Information page. Scroll to the App Credentials section. Copy the Client ID and click Show next to Client Secret to reveal and copy the secret — you'll need both when configuring the Frontegg portal.
Keep your Client Secret safe
Keep your Client Secret safe
The Client Secret authenticates your Frontegg integration to Slack. Never share or commit it to version control.
In the left sidebar, click OAuth & Permissions. Under Redirect URLs, click Add New Redirect URL and enter the redirect URL shown in the Frontegg portal for this integration — copy it whole, including the path. See How to get your Redirect URL.
The value has this shape, but take the real one from the portal rather than assembling it:
https://YOUR_MCP_GATEWAY_URL/integration-callback
Click Add, then Save URLs.
The Redirect URL now appears in the list. Verify the URL matches your Frontegg MCP Gateway exactly — a mismatch will cause the OAuth flow to fail with bad_redirect_uri.
Scroll down to Scopes. Frontegg uses User Token Scopes (not Bot Token Scopes) — Slack issues a user token that acts on behalf of the user who authorizes the app. Click Add an OAuth Scope under User Token Scopes.
Use User Token Scopes, not Bot Token Scopes
Use User Token Scopes, not Bot Token Scopes
Frontegg requests user tokens via Slack's user_scope parameter. Scopes added under Bot Token Scopes are not granted to the user token and won't be available to Frontegg.
Type each scope name into the search box and select it from the dropdown. Select the following scopes:
| Scope | Description |
|---|---|
users.profile:read | View profile details about people in the workspace |
users:read | View people in the workspace |
users:read.email | View email addresses of people in the workspace |
team:read | View the workspace's name, domain, and icon |
channels:read | View basic information about public channels |
channels:write | Manage public channels and their membership |
channels:history | View messages and other content in public channels |
groups:read | View basic information about private channels |
groups:write | Manage private channels and their membership |
groups:history | View messages and other content in private channels |
im:read | View basic information about direct messages |
im:write | Start direct messages with people |
im:history | View messages and other content in direct messages |
mpim:read | View basic information about group direct messages |
mpim:write | Start group direct messages |
mpim:history | View messages and other content in group direct messages |
chat:write | Send, update, and delete messages |
files:read | View files shared in channels and conversations |
files:write | Upload and delete files |
search:read | Search the workspace's content |
Add all of them, and nothing more
Add all of them, and nothing more
Slack fails the entire authorization when any single requested scope cannot be granted, so a missing scope breaks the connection completely rather than only the matching operations. For the same reason, do not add admin.* scopes: they require an Enterprise organization and an org-wide install, and on a normal workspace they take the whole integration down.
Once you have your Client ID and Client Secret, enter them in the Frontegg portal:
- Open the Frontegg portal and navigate to [ENVIRONMENT] → Integrations → Slack.
- Enter the Client ID and Client Secret in the corresponding fields.
- Select the required scopes.
- Click Save.
When a user authorizes the integration, Slack will prompt them to choose the workspace where the app should be installed and to approve the requested scopes.
Adding a scope later needs a fresh authorization
Adding a scope later needs a fresh authorization
Scopes are granted once, when the user authorizes the app. If you add a scope afterwards, existing connections keep their old grant and the new operations stay unavailable until each user reconnects.
- A person can be reached by email alone: looking them up by address yields a user, opening a direct message with that user yields a channel, and a message can then be posted to it.
- Messages can be updated and deleted after posting, and a permalink can be generated for any message.
- Channels can be created, renamed, archived and unarchived, given a topic or purpose, and have members invited or removed.
- Messages are attributed to the app, not to the person who authorized it. Even though the integration uses a user token, a posted message shows the app as its author, so it does not read as "sent by me".
- Listings return at most 999 items per page and are paged with a cursor. File listings are the exception and use page numbers instead.
- Listing a user's conversations returns public channels only unless other conversation types are asked for explicitly — direct messages and private channels are not included by default.
- Slack's message search is a legacy method and works only with a user token. It also needs its own scope, so on an existing connection it stays unavailable until the user reconnects.
- Reading a workspace's people returns personal data, including email addresses, so those listings should be handled accordingly.