Slack

Covers the SystemChannelSlack records Brain Station 23 owns: the Slack App credentials every organization's workspace connections run on, and the bot pool that lets more than one Slack App exist. For the org-facing "Add to Slack" install flow, see Channels → Slack.

Fields on a system config

1. client_id
2. client_secret
3. signing_secret

1. Fields

Field	Type	Constraints
client_id	string	required, ≤100 chars
client_secret	text	required
signing_secret	string	required, ≤255 chars
bot_scopes	JSON array	default ["chat:write", "app_mentions:read", "im:history", "im:read", "im:write"]
organization_id	UUID	optional; see org scoping
name	string	display name, ≤100 chars, default Default Slack App
is_primary	bool	set by the server, not the client

Unlike the Teams bot_scopes, Slack's bot_scopes are OAuth scopes: they're passed directly into the "Add to Slack" authorization URL as the requested bot token scopes.

The response for a config also returns webhookUrl ({BASE_URL}/api/v1/webhooks/channels/slack/events) and oauthRedirectUrl ({BASE_URL}/api/v1/channels/slack/oauth/callback). These are the two URLs to paste into the Slack app's Event Subscriptions and OAuth & Permissions pages when creating the Slack App at api.slack.com.

2. Bot pool

More than one system config can exist. Base path /api/v1/system/channels/slack.

• The first config created becomes primary automatically. is_primary cannot be changed through the update endpoint, and the primary cannot be deleted (400).
• Deleting a config a SlackIntegration still references returns 409.
• Org scoping is a single nullable organization_id column on the config row. There is no assignment table and no /available endpoint, unlike Teams. The install flow (see Channels → Slack) picks a config by explicit ID or falls back to the primary.

Routes require an authenticated user and nothing more. There is no role check.

Event verification always uses the primary config

POST /webhooks/channels/slack/events is a single endpoint for every connected workspace. It verifies the request signature using SystemChannelSlack.get_primary().signing_secret unconditionally. It does not look up which system config the matching SlackIntegration (by team_id) was created against. A non-primary config with a different signing secret than the primary's Slack App will fail signature verification for any workspace installed through it.