स्लैक ग्रीन ब्लॉग

We broke a Slack bot nine ways on 1 October 2026, in Socket Mode and over HTTP, and wrote down what the person in Slack saw and what the app received each time. The table of causes, symptoms and fixes comes from those runs.

A Slack bot can DM a user by passing the user ID as the channel in chat.postMessage, or by opening the DM with conversations.open first. We ran both, recorded where each message landed, and reproduced messages_tab_disabled and 'Sending messages to this app has been turned off'.

We made a Slack Events API endpoint fail on purpose and logged every redelivery with its X-Slack-Retry-Num and X-Slack-Retry-Reason headers. Slack retried 3 times, at about 0 s, 1 minute and 6 minutes. Measured timing, what X-Slack-No-Retry does, and a handler that stops the retries.

Slack signs every request with your app's signing secret: HMAC-SHA256 of v0:timestamp:raw body. We verified a real slash command and a real event on 1 October 2026, then broke it the four ways apps break it.

A Slack message link is /archives/<channel>/p<ts without the dot>. We copied links in Slack web and called chat.getPermalink on 1 October 2026 to compare the formats for channel messages and thread replies, then turned links back into a channel and ts.

We created a channel canvas with the Slack API, wrote markdown into it, found sections and edited them, then read it back. The free-plan errors, the markdown that rendered and the mention syntax that did not.

We called reactions.add with standard, aliased, skin-tone and custom emoji names in a test workspace, then kept adding reactions until Slack refused. Every response, the reaction_added payload, and the per-user limit we hit.

Slack verifies an Events API Request URL by POSTing a url_verification challenge. We ran a 16-line Flask handler behind a tunnel and recorded the request, the Verified tick, and the exact error Slack shows for a wrong body, an HTTP error and a slow reply.

We built a Slack App Home tab with views.publish in a test workspace and recorded the app_home_opened payload, every error a bad view returned, and what users see when the Messages tab is off or read-only.

We added localhost, 127.0.0.1, https, custom-scheme and tunnel redirect URLs to a Slack app on 1 October 2026, then ran the OAuth flow against a local server. What was accepted, how Slack matches the URL, and the PKCE rules.

A Slack app manifest we used to create a working app on 1 October 2026, in YAML and JSON, plus the validation errors from broken versions and real output from apps.manifest.validate, export, create and update.

chat.delete removes a message by channel and ts. We deleted bot messages, a person's messages, a thread parent and an already deleted message with bot and user tokens, and list every response, including cant_delete_message and the tombstone a thread parent leaves.

We opened a Slack modal with views.open after delays from 0 to 5 seconds, 28 times, on 1 October 2026. The success rate per delay, the exact errors, and the Bolt code that avoids expired_trigger_id.

users.lookupByEmail turns an email address into a Slack user ID. It needs the users:read.email scope. We ran it with the right and wrong emails, upper case, spaces and a token without the scope, in curl and Python, and list every response.

We sent Block Kit messages just under and just over each limit through chat.postMessage and an incoming webhook on 1 October 2026. The last value that worked, the first that failed, and the exact error text for each.

We called auth.test with no token, a broken token, a revoked token and tokens from an uninstalled and a deleted app, and wrote down every response. invalid_auth, not_authed, account_inactive and token_revoked each point to a different fix.

search.messages works only with a user token that has search:read. We ran it against our own test workspace: the response shape, the bot token error, 10 search modifiers with their counts, paging limits that fail silently, how long new messages take to show up, and the newer assistant.search.context.

To reply in a Slack thread, pass the parent message's ts as thread_ts. We tested it with a bot token, a webhook and Socket Mode events on 1 October 2026, including the values that silently post to the channel instead.

We sent ephemeral messages with chat.postEphemeral, in a channel and in a thread, then tried chat.update and chat.delete on them, replaced and deleted them through response_url, and checked what was left after a reload. Every response is from the real run.

We called chat.update with a bot token and a user token on 1 October 2026: the response, every error we hit, the 4,000-character cap, and what an edit shows and notifies in Slack.

A 13-line Bolt for Python app that answers in Slack over Socket Mode, run against a real workspace, plus the exact errors from the wrong token, a missing connections:write scope, and two copies running at once.

We called chat.scheduleMessage with a bot token for times from 10 seconds to 121 days ahead, listed and deleted the results, and watched which messages still arrived. The limits, the exact errors, and a delete that returned ok but did not stop the post.

Slack invite links expire after 30 days and have no longer option. We made links in a test workspace, deactivated them, and found a signed-out check that tells a live link from a dead one.

Unpin from the Pins tab or the message menu, then confirm Remove Pinned Item. We tested pinning, unpinning, edits, deletes, has:pin search and the 100-pin limit in Slack for web.

Slack's Set up mobile overrides checkbox lets your phone get a different notification level than your computer. We ticked it in every combination and read back the saved settings after each click.

Slack has no superscript format. We sent ^2^, ², x^2 and Unicode characters from the message box, the API and a Block Kit markdown block: only Unicode rendered raised. Copy-ready characters, and how Slack search treats them.

Call conversations.history, follow next_cursor, then fetch each thread with conversations.replies. We read 40 seeded messages and 6 replies from a test channel and show the script, its output, and what limit, oldest and latest did.

Three short Python scripts that post to Slack, run against a real workspace with their output: an incoming webhook with requests, chat_postMessage with a bot token, and a thread reply. Plus the errors we triggered and what an 80-message burst did.

The official Slack MCP server lives at https://mcp.slack.com/mcp and needs a user token from an app with MCP turned on. We built one, connected Claude Code and Codex CLI, sent a message and searched for it, and copied every response.

Slack messages can now carry real charts. We posted line, bar, area and pie charts and a sortable data table to a test workspace with a bot token, a webhook and a user token, and logged every limit Slack enforced.