KeyKeeperSlack · OAuth rotating token bundle
How an agent gets a Slack · OAuth rotating token bundle key through KeyKeeper, what to choose on api.slack.com, and how KeyKeeper verifies it.
| Template id | slack-oauth-rotating (also slack-token-rotation) |
|---|---|
| Field | slack-bot-token → SLACK_BOT_TOKEN · secret |
| Also | slack-refresh-token → SLACK_REFRESH_TOKEN · secret |
| Also | slack-client-id → SLACK_CLIENT_ID · plain, confirmed by you |
| Also | slack-client-secret → SLACK_CLIENT_SECRET · secret |
| Key looks like | starts with xoxe.xoxb-, whether it can be viewed again is unconfirmed |
| Created at | api.slack.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show slack-oauth-rotating
keykeeper save --provider slack-oauth-rotating --from-clipboard --create --purpose "what this task does"
keykeeper run -c slack-oauth-rotating -- <your command>--provider slack-oauth-rotating fills in the credential id and the fields. The environment
variables are the ones Slack's own tools read, so nothing has to be mapped.
What only you can do
Sign in to Slack
Create/select an OAuth app
Enable token rotation
Install it and capture the complete access/refresh bundle
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Grant only method-specific bot scopes. Access tokens last 12 hours; the consuming workflow must exchange the refresh token and update this bundle safely.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Slack · OAuth rotating token bundle key (starts with
xoxe.xoxb-, whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value. - After saving: Slack · OAuth rotating token bundle offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
Rotating Slack access tokens last 12 hours. The stored date is only a reminder; the caller must perform refresh-token rotation.