Slack OAuth 2.0 Scopes & auth.revoke API: Detecting Stale Tokens

Slack OAuth 2.0 Scopes & auth.revoke API

The goal is to programmatically identify when a Slack token has become stale after revocation or deletion, ensuring least‑privilege enforcement remains accurate. Slack’s OAuth 2.0 flow issues a token bound to requested scopes, but the auth.revoke endpoint returns 200 OK even if the token was already revoked, offering no explicit flag for stale state. Additionally, revoking a bot token does not automatically invalidate associated user tokens for the same app, creating a potential gap in privilege separation. There is also uncertainty whether revocation clears cached authentication entries in third‑party integrations.

Given these constraints, how can a developer reliably detect that a token has been revoked or is no longer valid? Does the auth.revoke response contain any metadata that can be used to confirm revocation status? And what mechanisms, if any, exist to propagate revocation to cached tokens in external systems?