OAuth token revoked during Slack app migration

Question

Goal
Move a lightweight Slack app from one workspace to another while avoiding service interruption.
Constraints & Uncertainty
Slack’s migration guide requires reinstalling the app in the target workspace, which revokes the original OAuth token and forces a new token to be issued. Event subscriptions and slash‑command URLs are not automatically transferred; they must be manually re‑configured. It is unclear whether the app’s previously subscribed events (e.g., message events) remain active after reinstall or if they must be re‑subscribed each time. Real‑time connections (RTM or Socket Mode) will drop when the token is revoked, but the documentation does not specify how to detect this or reconnect gracefully without losing messages.
Unresolved Questions

Does Slack automatically re‑subscribe to previously configured event types after a reinstall, or must the app perform a full re‑subscription?
What is the recommended approach for detecting OAuth token revocation and reconnecting to Socket Mode or RTM to avoid downtime?
Is there a documented pattern to minimize or eliminate downtime during the migration window, especially for high‑traffic apps?

Siddharth · Answer

Answer first
An app installation cannot be moved between Slack workspaces. Reinstalling in the target workspace creates a new installation with a new OAuth token and revokes the source token. Event subscriptions, slash-command and interactive URLs are per installation and are not transferred automatically. There is no documented zero-downtime workspace move; the supported pattern is parallel operation with a controlled cutover and explicit re-subscription in the target.
Confirmed facts

An OAuth access token is bound to a specific workspace installation. Reinstalling in a new workspace issues a new token and the previous token becomes invalid immediately.
Event Subscription request URL, subscribed event types, and slash-command/interactive component URLs are configuration per workspace installation. They must be reconfigured in the target workspace via app settings or app manifest.
Real-time transports terminate when the app-level token is revoked. Socket Mode connections close and RTM websockets terminate.

Likely explanation

Slack does not automatically restore previous event subscriptions after a reinstall in a new workspace. Subscriptions are stored with the installation, not with the app code. The app must ensure Event Subscriptions are enabled for the new installation and the desired events are listed.
Token revocation is observable via API responses indicating invalid authentication and via real-time transport termination. The app should treat auth errors and disconnects as a signal to stop using the old token and switch to the new installation credentials.
Slack does not queue or backfill events missed while the token is revoked and the connection is down.

Steps needed for this case

Keep the source installation active. Do not uninstall until cutover is verified.
Install the app in the target workspace. Capture the new Bot User OAuth Token and Installation ID from the app management UI. They will differ from the source.
Reconfigure the target installation: set the Event Subscriptions Request URL, enable the required event types, and set slash-command and interactive component Request URLs. These settings do not carry over.
Pass URL verification and test delivery. Send a test event or slash command in the target workspace and confirm receipt at the configured Request URL.
Run the app with both source and target credentials during a cutover window. Route new workspace traffic to the new token; keep the old token serving the source workspace until you confirm event delivery on the target.
Retire the source installation only after traffic is confirmed on the new token. Users must re-grant scopes in the target workspace; bot permissions and user tokens from the source do not carry over.

Verification checks: compare Bot User OAuth Token and Installation ID for source and target to confirm they are distinct; monitor API responses after cutover for authentication errors to ensure the old token is no longer in use.
One missing diagnostic detail that changes the recommendation: does the app use Socket Mode with an app-level token, or HTTP Events only? Reconnect strategy differs, and Socket Mode requires explicit handling of disconnects and token swap versus HTTP retry behavior.

OAuth token revoked during Slack app migration

Goal

Constraints & Uncertainty

Unresolved Questions

1 answer

Answer first

Confirmed facts

Likely explanation

Steps needed for this case

Your perspective belongs here.

0 question comments