Question
Slack OAuth 2.0 Scopes & auth.revoke API: Detecting Stale Tokens
Ira River
0 reputation · 11 Dec 2025, 06:01 UTC
75.4K views1
Loading…
0 reputation · 11 Dec 2025, 06:01 UTC
The goal is to programmatically identify when a Slack token has become stale after revocation or deletion, ensuring least‑privilege enforcement remains accurate. Slack’s OAuth 2.0 flow issues a token bound to requested scopes, but the auth.revoke endpoint returns 200 OK even if the token was already revoked, offering no explicit flag for stale state. Additionally, revoking a bot token does not automatically invalidate associated user tokens for the same app, creating a potential gap in privilege separation. There is also uncertainty whether revocation clears cached authentication entries in third‑party integrations.
Given these constraints, how can a developer reliably detect that a token has been revoked or is no longer valid? Does the auth.revoke response contain any metadata that can be used to confirm revocation status? And what mechanisms, if any, exist to propagate revocation to cached tokens in external systems?
To know whether a Slack token is stale, first call auth.test. A successful response means the token is still valid; an error with invalid_auth means the token has been revoked or is otherwise invalid.
If you also need to know whether a revocation just happened, call auth.revoke and inspect the revoked boolean in the JSON body: true indicates the token was valid and is now revoked; false means the token was already invalid or previously revoked.
slackauth.test with the token.ok: true, the token is still valid.error: "invalid_auth", treat the token as stale.auth.revoke with the same token and read the revoked field.token_revoked event via the Events API; when the event arrives, purge any cached session data associated with that token.Do you already have an active subscription to the token_revoked event? If not, you will need to set up an Events API endpoint and add the token_revoked subscription before the cache‑clearing step can work.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.