KeyKeeperSlack · Bot Token (non-rotating)
How an agent gets a Slack · Bot Token (non-rotating) key through KeyKeeper, what to choose on api.slack.com, and how KeyKeeper verifies it.
| Template id | slack |
|---|---|
| Field | slack-bot-token → SLACK_BOT_TOKEN · secret |
| Key looks like | starts with xoxb-, whether it can be viewed again is unconfirmed |
| Created at | api.slack.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show slack
keykeeper save --provider slack --from-clipboard --create --purpose "what this task does"
keykeeper run -c slack -- <your command>--provider slack fills in the credential id and the field. The environment
variable is the one Slack's own tools read, so nothing has to be mapped.
What only you can do
Sign in to Slack
Create or select an app
Add only the required Bot Token Scopes
Install the app to the intended workspace
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Use a bot token, not a user token. Add only method-specific bot scopes (for example chat:write); avoid user impersonation and legacy umbrella scopes.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Slack · Bot Token (non-rotating) key (starts with
xoxb-, whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: Slack · Bot Token (non-rotating) offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at api.slack.com.