Skip to main content

Get credentials

1

Create a Slack app

Go to api.slack.com/apps and click Create New App > From scratch. Name your app and select a development workspace.
2

Configure OAuth and permissions

Navigate to OAuth and Permissions. Under Redirect URLs, add:
Under Scopes > User Token Scopes, add openid, email, and profile.
3

Copy credentials

Go to Basic Information and copy the Client ID and Client Secret under App Credentials.
KavachOS uses Slack’s OpenID Connect flow (/openid/connect/authorize), not the older identity.basic scope approach. Make sure you add User Token Scopes, not Bot Token Scopes.

Configuration

lib/kavach.ts

Scopes

Default scopes: openid email profile These are standard OIDC scopes that Slack supports. No additional User Token Scopes are needed for basic sign-in.

User data returned

The user ID is scoped to a workspace, not to the Slack user globally. If a user belongs to multiple workspaces and signs in with different ones, they will be treated as different accounts unless you implement custom linking logic.
Last modified on April 29, 2026