स्लैक ग्रीन ब्लॉग

We opened a Slack modal, pushed views until Slack refused, updated the top view with a current and a stale hash, and answered view_submission with every response_action. Every response and what the user saw.

We posted all four common select menus from a Socket Mode app, picked a value in each, logged the block_actions payloads, and timed an external_select options handler from 0 to 5 seconds. Past 3 seconds Slack silently shows the old results.

We upgraded a Socket Mode Bolt for JS app from 4.6.0 to 5.1.0 and ran it on Node 18, 20, 22 and 26. Two changes failed silently, and a fresh install crashed on Node 20 until we pinned undici 7.

We sent 11 bot messages with different text and blocks combinations to a Slack DM and recorded the notification Slack asked the browser to show for each. Blocks win, text is the fallback, and Slack fills in text when you leave it out.

We called assistant.threads.setStatus and agents.sessions.setStatus on a test app before and after turning on the agent feature, clicked the stop button, and timed how long the status line stays. Every response, the stop event, and what Slack showed.

We caught the payload a slash command sends, answered it as ephemeral, in_channel, plain text and empty, posted to its response_url until it failed, and typed the command inside a thread. Every result is from a test app on 2 October 2026.

We wrote a one-tool MCP server, added it to a Slack app with the mcp_servers manifest field, switched it on in Slackbot and asked for the time. Every request Slackbot sent to the server, the permission prompt, and what Slackbot said when the server was down.

We posted image blocks pointing at our own server with PNG, JPG, GIF, WebP and SVG files, a 404, a redirect, slow responses and files from 2 MB to 42 MB, then used slack_file uploads. What rendered, what failed with downloading image failed, and where the 20 MB line sits.

App incoming webhooks are current. The old 'Incoming WebHooks' custom integration carries a deprecation notice but could still be added on 2 October 2026. We added both, sent channel and username overrides, and posted 60 messages at once to look for a 429.

conversations.members returns the user IDs in a channel, bots included. We ran it on public and private channels with the bot inside and outside each, joined the IDs to names and emails, and hit a cursor that pointed at an empty page.

We added two custom emoji and an alias to a test workspace, then called emoji.list, admin.emoji.add and emoji.add with bot and user tokens on 2 October 2026. emoji.list returned 18 entries while the admin page said 3, and every add call was refused.

We took a new app from 'Activate Public Distribution' greyed out to a working listing form on 2 October 2026. Four checks gate distribution, one HTTP redirect URL is enough to fail the HTTPS check, and the Marketplace asks for 10 active workspaces before you can submit.

We subscribed a Socket Mode app to message.channels, then posted, edited, deleted, replied in a thread, sent a reply to the channel and pasted a link. The raw event for each, three message_changed events nobody typed, and the filter that stopped our bot answering them.

We revoked a user token and a bot token with auth.revoke, then every token at once with the Revoke Tokens button, and logged each response, each event and what kept working. Then we reinstalled and checked the new tokens.

We called users.info and users.profile.get for a person, a bot and Slackbot, changed the person's display name in between, and logged which fields moved. Code, output, the email scope test and every user_not_found case we hit.

Slack paginates list methods with a cursor: pass response_metadata.next_cursor back as cursor until it is empty. We paged 27 real messages on 2 October 2026 and broke the cursor five ways to see which ones fail.

A Slack app created today cannot use the RTM API. We called rtm.connect and rtm.start with every token a new app gets on 2 October 2026, tried to request the rtm:stream scope, and ran the same bot over Socket Mode.

icon_emoji, icon_url and username only work with the chat:write.customize scope, and Slack ignores them silently without it. We tested every case on 2 October 2026, plus webhooks and the app icon upload limits.

We sent chat.postMessage with as_user=true, as_user=false and no as_user, with a bot token and a user token. as_user=true changed nothing, as_user=false was rejected, and only the user token posted under the person's name.

A Slack bot has three IDs: a user ID (U...), a bot ID (B...) and an app ID (A...). We called auth.test with a bot, user and app-level token on 2 October 2026 and show where each ID turns up.

We ran Slack's Add to Slack flow against a 34-line Python callback on localhost, then broke each step: a reused code, a typo, a wrong secret, a wrong redirect_uri, a cancelled consent screen and a code we held for 11 minutes.

With token rotation on, Slack access tokens start with xoxe. and expire after 12 hours. We turned it on for a test app on 2 October 2026, refreshed the token six times, and logged which old tokens kept working.

conversations.list returns every public channel but only the private channels your bot is in. We ran it with a bot token and a user token on 2 October 2026 and pasted what each one returned.

We posted rich_text blocks with every element type, lists nested 9 levels deep, quotes and code, then broke them on purpose. The JSON we sent, screenshots of how Slack web drew it, and the exact invalid_blocks errors.

We added people and bots to public and private channels with conversations.invite and conversations.join, using a bot token and a user token. Every response we got, including already_in_channel, cant_invite_self, cant_invite and the force flag.

We called users.list with a bot token in a one-person workspace and got 14 members back: Slackbot, 1 person, 4 live bots and 8 deleted ones. The script, the curl call, cursor paging to the end, and what users:read.email changes.

We pointed a slash command at a local server and broke it on purpose: HTTP 500, 401 and 302, a wrong path, a dead tunnel, a stopped server and Socket Mode with no process. Each one gave dispatch_failed. A slow reply gave operation_timeout instead.

We clicked a button, a static_select and a datepicker in Slack on 1 October 2026 and logged the block_actions payloads our app received. Then we measured response_url: 5 posts, then used_url; it worked at 29:50 and was dead at 30:10.

We posted a web page, a YouTube video and an image with every combination of unfurl_links and unfurl_media on 1 October 2026, then built a custom preview with link_shared and chat.unfurl. The flags do not split the way the names suggest.

We scheduled five messages for 4:40 PM on 1 October 2026, then archived, left and deleted their channels and deleted a thread parent before the send time. Two sent, three never did, and Slack gave no notice about the three.