Slack Bot Token: How to Get One, and xoxb vs xoxp Explained

A Slack bot token starts with xoxb- and lets your app act as its own bot user. To get one, create an app at api.slack.com/apps, open OAuth & Permissions, add Bot Token Scopes such as chat:write, click Install to Workspace, approve it, and copy the Bot User OAuth Token. A user token starts with xoxp- and acts as the person who approved it. Slack's docs recommend bot tokens for most apps, because they stay working even if the installing user is deactivated.

Some things only a user can do: a bot has its own presence and cannot set yours, for example. That is why tools that keep your own Slack dot green, like Slack Green, use your signed-in session rather than a bot token; the difference is covered in Slack xoxc and xoxd tokens.

How to get a Slack bot token

• Go to api.slack.com/apps, click Create New App, choose From scratch, name it and pick the workspace.
• Open OAuth & Permissions and add Bot Token Scopes, for example chat:write to post and users:read to read people and presence.
• Click Install to Workspace and Allow. Some workspaces require an admin to approve new apps.
• Copy the Bot User OAuth Token (xoxb-...) and store it as a secret, never in code or a public repository.
• Invite the bot to any channel it needs to post in: /invite @your-bot.

When you add scopes later, reinstall the app so the token gets them.

Test it:

curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" https://slack.com/api/auth.test

Slack token types and prefixes



Prefix	Token	Acts as
xoxb-	Bot token	Your app's bot user
xoxp-	User token	The user who approved the app
xapp-	App-level token	The app across all its installs
xoxe.xoxb-, xoxe.xoxp-	Rotating access token	Bot or user, expires after 12 hours
xoxe-	Refresh token	Used to get a new access token
xwfp-	Workflow token	A workflow step, for at most 15 minutes
xoxc-, xoxd-	Web client session	You, as the Slack web app

Slack's docs also describe configuration tokens for the App Manifest APIs and service tokens for apps built with the Deno Slack SDK.

xoxb vs xoxp

A user token also carries user scopes that the user approved. Slack's docs note that user token actions are performed as if by the user themselves.

xoxe tokens and token rotation

If you turn on token rotation in your app settings, oauth.v2.access returns an access token with an xoxe. prefix that expires after 43,200 seconds (12 hours), plus a refresh token starting with xoxe-. Call oauth.v2.access with grant_type=refresh_token before it expires to get a new pair.

xapp app-level tokens

App-level tokens start with xapp- and come from Basic Information in your app settings. They are for app-wide APIs, most often Socket Mode connections, not for posting messages.

Which token can set presence?

users.setPresence sets the calling user's presence to away or auto, so with a user token it changes the user's own dot; a bot token changes the bot's. No token can force a user to active. Code and fields are in our Slack presence API guide.

FAQ

How do I get a Slack bot token?

Create an app at api.slack.com/apps, add bot scopes, install it to your workspace, and copy the Bot User OAuth Token from OAuth & Permissions.

What is the difference between xoxb and xoxp?

xoxb acts as your app's bot. xoxp acts as the user who approved the app.

Do Slack bot tokens expire?

Not unless you turn on token rotation; then access tokens expire after 12 hours and you refresh them.

What is an xoxe token?

With rotation on, xoxe. prefixes a short-lived access token and xoxe- starts the refresh token.

What are xoxc and xoxd tokens?

The web client's session token and cookie; see Slack xoxc and xoxd tokens.