Will I Get Caught Using Slack Green? What Admins Can See
What coworkers, workspace admins and IT can see when Slack Green runs, measured in a real Slack access log: a web session from our server's IP, every 6 hours.
Reading on your phone?
Run the idle test on your computer
Slack sets you away on your computer, so this free test runs there. Send yourself this page and press Start at your desk.
No tool that signs in to Slack is invisible, and Slack Green is no exception. Coworkers only see your dot. A workspace admin on a paid plan can see the session our server opens: it appears in the access logs as "Slack Web App" from an IP address that is not yours. Whether that gets you in trouble depends on your employer's policy, so this page shows what each person can see, measured in our own workspaces on 29 September 2026.
What the access log shows
Every Slack account has an access log at your-workspace.slack.com/account/logs. On paid plans, Owners and Admins can see the same kind of log for every member. We opened ours in a workspace where Slack Green keeps the account active. The crop below keeps only the rows from our server.
All three rows are the Slack Green server (IP hidden). Our own browser and phone logins from the same days are cut out of the picture.
What the picture tells an admin:
- • Client: our server's sessions show as "Slack Web App", the same label as a browser tab, because the server connects the way the web client does.
- • IP and place: your own sessions show a city and an internet provider next to the IP. Ours shows a fixed server IP with no city. Anyone who looks it up finds a server, not your home network.
- • Timing: the server lines come at fixed times, 4:00 AM, 10:00 AM, 4:00 PM and 10:00 PM here. They match our token check, which confirms every 6 hours that your session is still valid. The 10:00 AM line is the check our database logged at 01:00:06 UTC.
So an admin who reads your log line by line can see a second web session from a fixed server IP, not your home network. The log does not name Slack Green, and it does not show what the session did. It does show that something other than your own devices is signed in as you.
What each person can see
| Who | What they can see | What we measured |
|---|---|---|
| Coworkers | A green or grey dot, and your status text | The presence API returns one field for another member: "presence": "away" |
| Workspace admin, free plan | Workspace totals in Analytics, no per-person log | team.accessLogs returned paid_only for our Owner account |
| Workspace admin, paid plan | Each member's access log: time, client, IP, location | Same fields as the log above, per member |
| IT on a company laptop | Apps, processes and browser extensions | Slack Green installs nothing on the device |
| You | Your own access log and connection count | /account/logs in any workspace |
The coworker row is the one most people worry about, and it holds the least. As the primary Owner of a test workspace we called Slack's presence API for another member. This is the whole reply:
{"ok": true, "presence": "away"}The same call for your own account returns more: online, auto_away, manual_away and connection_count. Slack only gives those fields to the account itself, not to admins. Presence says nothing about what you did, which is why the dot was never a measure of work. What an employer can see through Slack beyond presence, plan by plan, is in can Slack be used to monitor employees, and message access is covered in can Slack admins see DMs.
Free plan and paid plan admins
On our free workspaces the Owner account cannot read anyone's access log. The API call team.accessLogs returned paid_only, and the old /admin/logins page showed Slack's "There's been a glitch" error. Analytics on the free plan counts active people for the whole workspace and adds, in Slack's own words, "Workspaces on a paid plan can view message and file data."
On Pro, Business+ and Enterprise plans, access logs are part of the admin tools, so the log in the picture above is readable by your admins for every member. Enterprise plans can also send those logs to a security tool that flags unusual IPs. Plan for the case where your admin looks.
What runs where
Where the risk is
The risk is your employer's rules, not a hidden alarm. Some contracts and IT policies cover shared sessions, automation or presence. If your admin reads access logs, the server session in the picture is there to be found. Read the policy before you decide, and if presence is used as a work meter at your company, a written response-time norm is a better fix than any tool.
Frequently asked questions
Does the log say "Slack Green"? No. It shows "Slack Web App", an IP address and a time. A lookup of the IP finds a server, not our name.
How do I remove the session? Sign out of Slack in the browser you copied the tokens from, or use "sign out of all sessions" on your access log page. The tokens stop working and the server lines stop.
Can Slack flag it without an admin looking? On Enterprise Grid, Slack's audit logs have "anomaly" events, which can flag a session from a new network (ASN) or IP. A session from a server IP may raise one. We could not test this, because our workspaces are on the free plan.
Does it change what analytics count? Slack's analytics count a person as active when they post a message or read a channel or DM. Slack Green's server keeps a connection open and sends activity pings. It does not post messages or mark channels as read.
Related Articles
Does Slack Show When You Were Last Active or Online?
No. Slack shows coworkers a present-tense dot and never a last-seen time. On paid plans, admins get a Last active date per member. Who sees what, and how to find someone's last message.
Does Slack Track Your Mouse Movement or Detect a Jiggler?
No. The Slack desktop app reads one number, how long the computer has been idle, plus each device's connection state. It does not record your mouse path, your screen or your keystrokes. The check, printed from the app's code.
Fake Slack Active Status: What Works and What Gets Noticed
Seven ways people fake an active Slack status, which ones hold up, and the thing that gives most people away. It isn't the dot.