Slack token rotation limits: user token expiry behavior without bot token rotation

Direct Answer

No, non-expiring bot-token behavior is not guaranteed across all workspace plans. Enterprise Grid organizations can enforce additional rotation or retention policies that invalidate bot tokens independently of app uninstall. User access tokens under rotation typically expire within 1 hour. Refresh tokens are single-use: each exchange returns a new access token and a new refresh token, invalidating the previous pair. Least-privilege implementations must handle bot-token invalidation separately from user-token refresh logic.

Confirmed Behavior (Per Current Documentation)

• User access tokens: Short-lived, ~1 hour lifetime when token rotation is enabled for granular-permission apps.
• Refresh tokens: Single-use with mandatory rotation on every exchange. The old refresh token is invalidated immediately after a successful oauth.v2.access call with grant_type=refresh_token.
• Bot tokens: Not automatically expired by the rotation mechanism. They remain valid until the app is uninstalled, a workspace admin revokes the token, or an Enterprise Grid org policy forces rotation.

Where Behavior Varies

Factor	Classic / Standard Plan	Enterprise Grid
Bot token expiry	Only on uninstall, revoke, or workspace reset	May be subject to org-level token rotation/retention policies
User token lifetime	~1 hour (configurable via app manifest? No — fixed by Slack)	Same baseline, but org admins can enforce shorter windows
Refresh token reuse	Strictly single-use	Strictly single-use

Practical Implications

1. Do not assume bot tokens are permanent. Build a bot-token validation path (e.g., periodic auth.test calls) and a re-install/re-authorization flow for when they eventually become invalid.
2. Track user-token expiry client-side. auth.test returns an expires timestamp, but it does not confirm whether a rotated token is still within its active window. Store the expires value from the token response and refresh proactively (e.g., 5–10 minutes before expiry).
3. Handle refresh-token rotation atomically. On each refresh, persist the new access token and the new refresh token together. If the refresh call fails, you cannot retry with the old refresh token — it is already invalidated.

Verification Steps for Your Workspace

1. Call oauth.v2.accessTokenScopes and auth.test with a rotated user token; note the expires timestamp.
2. Wait until near expiry, then call oauth.v2.access with grant_type=refresh_token. Confirm you receive a new access token, new refresh token, and that the old refresh token is rejected on a second attempt.
3. In an Enterprise Grid org, ask the org admin whether any token-rotation or session-duration policies are enforced at the org level.

One Diagnostic Detail That Changes the Recommendation

Are you operating in an Enterprise Grid organization with org-level token policies enabled? If yes, bot tokens may be forcibly rotated on a schedule independent of your app. If no (Classic/Standard plan), bot tokens only expire on uninstall, revoke, or workspace reset.