Slack bot token config

Use this when collecting or rotating the per-app Slack Bot User OAuth Token for OS Slack smoke testing.

Goal#

Each Slack app should own its complete runtime config in APP_CONFIG_INTEGRATIONS__SLACK:

{
  "oauthClientId": "...",
  "oauthClientSecret": "...",
  "webhookSigningSecret": "...",
  "botToken": "xoxb-..."
}

OS Slack Web API calls use the connected project workspace bot token first. If Slack rejects that token, OS verifies that this environment's APP_CONFIG_INTEGRATIONS__SLACK.botToken belongs to the connection's recorded Slack team before retrying with it. Projects without a live Slack connection cannot use the fallback token. This token is optional operational fallback, not the source of a project's Slack connection and not production-recreation material. A configured value can be revoked; validate it with auth.test against its expected team rather than treating Doppler presence as proof.

Niterate (CI bot) is not the production Slack app. The production Slack app is iterate; Niterate (CI bot) is the visible identity associated with the legacy shared CI/smoke token.

Current status#

As of July 2, 2026, Doppler has botToken embedded in APP_CONFIG_INTEGRATIONS__SLACK for these os configs:

dev
dev_jonas
dev_misha
dev_rahul
prd
preview_1
preview_2
preview_3
preview_4
preview_5
preview_6
preview_7
preview_8
preview_9

This is an inventory of configured values, not a validity statement. During the July 17, 2026 production recreation, the configured prd value returned invalid_auth; the normal project OAuth installation was therefore required. Affected workers still need to be redeployed before they can use newly uploaded Doppler values.

Never restore a project by writing this value into /secrets/integrations/slack/<connection>/bot-token and manually appending connection or directory facts. Complete Connect Slack OAuth, then run the post-recreation verifier.

OAuth pages#

Open the app's OAuth & Permissions page, then copy Bot User OAuth Token. It should start with xoxb-.

Paste-back form#

Do not commit a filled copy of this file. Use this only for future rotations; paste filled values back to the agent, or use a private temporary file outside the repo.

SLACK_APP_BOT_TOKENS
 
config_name:
  app_id:
  bot_token:

Doppler update shape#

Merge botToken into the existing JSON. Do not replace the OAuth client ID, OAuth client secret, or webhook signing secret.

existing="$(
  doppler secrets get APP_CONFIG_INTEGRATIONS__SLACK \
    --project os \
    --config preview_N \
    --plain
)"
 
updated="$(
  jq -c --arg bot "$SLACK_BOT_TOKEN" '. + {botToken:$bot}' <<<"$existing"
)"
 
doppler secrets set APP_CONFIG_INTEGRATIONS__SLACK="$updated" \
  --project os \
  --config preview_N \
  --silent

Verify shape without printing secret material:

doppler secrets get APP_CONFIG_INTEGRATIONS__SLACK \
  --project os \
  --config preview_N \
  --plain |
  jq -e '.oauthClientId and .oauthClientSecret and .webhookSigningSecret and .botToken' >/dev/null