verapli
Sign inJoin free
Menu

Guides · productivity · Verification-gated

Slack app and Slack Marketplace listing

Create a Slack app in a development workspace, add scopes, install it and copy its tokens and signing secret. To offer it to other workspaces, activate public distribution; to list it in the Slack Marketplace (formerly the App Directory) it needs 10+ active workspaces and passes a preliminary and a functional review.

Researched · not yet run liveLast researched 25 October 2026 · Slack (Salesforce) · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

A Slack app is created by a Slack user and belongs to a development workspace (Enterprise org admins may also have to approve installs). Each workspace that installs the app gets its own bot/user tokens via OAuth. Marketplace listing is a separate review on top of public distribution.

  • Slack user in a development workspace personal owned by the personCreates and manages the app at api.slack.com/apps.
  • Development workspace organisation owned by the companyThe workspace the app is developed and first installed in.
  • Slack app developer · under Development workspaceHolds client id/secret, signing secret, scopes, and per-install tokens.

Commercially distributed apps outside the Marketplace ("unlisted") get much lower rate limits on conversations.history and conversations.replies.

Have ready

  • A public landing page made for the Slack app (overview, how it works, install path, next steps, privacy link) · Required for a Marketplace listing; PDFs and repo links are not accepted. [6]Needed for: Submit to the Slack Marketplace (optional)
  • Privacy policy covering data collected, use, retention, access/deletion requests and a contact email or webform [6]Needed for: Submit to the Slack Marketplace (optional)
  • Public support contact (email or form) able to respond within 2 business days [6]Needed for: Submit to the Slack Marketplace (optional)
  • Video showing installation, OAuth, setup, end-to-end use and uninstall (plus optional 30-90 s public YouTube listing video) [5]Needed for: Submit to the Slack Marketplace (optional)
  • Test account credentials with dummy data for any third-party service the app uses [5]Needed for: Submit to the Slack Marketplace (optional)
  • At least 10 active workspaces using the app in the past 28 days · Apps below this cannot submit to the Marketplace. [5]Needed for: Submit to the Slack Marketplace (optional)
  • Screenshots 1600 x 1000 px (8:5), JPG/PNG under 2 MB, and a short description of 10 words or fewer [6]Needed for: Submit to the Slack Marketplace (optional)

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Sign in to Slack in your development workspace

    Sign in yourself to the workspace where you will build the app.

    • Guided by hand
    • Human step: You sign in

    Where: https://api.slack.com/apps

  2. Create the app

    At api.slack.com/apps choose Create an app, give it a name and pick the development workspace, then press Create.

    • verapli co-pilot
    • Human step: You press submit
    • After: Sign in to Slack in your development workspace

    Where: https://api.slack.com/apps

  3. Add scopes and install to the workspace

    Under OAuth & Permissions add only the bot scopes you need (user scopes only if acting as a user), then Install to Workspace and Allow. Reinstall after adding scopes.

    • Guided by hand
    • Human step: You press submit
    • After: Create the app

    verapli captures SLACK_BOT_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (2)
    • New feature fails with missing_scope after you added a scope: Reinstall the app to the workspace so the token gets the new scopes. [1]
    • Install is blocked pending admin approval: Ask a workspace admin to approve the app [to verify exact admin flow for your plan].

  4. Copy the signing secret and client credentials

    From Basic Information copy the Signing Secret (to verify incoming requests) and, for OAuth distribution, the Client ID and Client Secret.

    • Guided by hand
    • After: Create the app

  5. Activate public distribution (optional)optional

    Under Manage Distribution complete the checklist (OAuth redirect URL, HTTPS on all request URLs) and Activate Public Distribution to get an Add to Slack button.

    • Guided by hand
    • Human step: You press submit
    • After: Add scopes and install to the workspace

  6. Submit to the Slack Marketplace (optional)optional

    Once the app is public, fully working and in 10+ active workspaces, submit it for review with the landing page, privacy policy, support details, test credentials, scope justifications and demo video. You press submit.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Activate public distribution (optional)
    The provider says
    Preliminary review up to 10 business days; functional review up to 10 weeks for new submissions (6 weeks for updates to published apps). Reviews cannot be expedited. [5]
    If something goes wrong (3)
    • Returned because the app is in private beta or not fully functional: Only submit a publicly installable, fully working app; test install, onboarding, use and uninstall on a workspace other than your dev workspace. [5]
    • Scopes questioned or rejected: Remove scopes for unbuilt features and any legacy, restricted or admin scopes; explain each remaining scope. Resubmitting resets your place in the preliminary queue. [5]
    • Reviewers cannot test: Provide working test credentials with dummy data and an install method (reviewers cannot use your workspace logins). [5]

  7. Ship changes to a listed appoptional

    A live listed app is locked. New functionality or scopes need resubmission with a video and a staging app; display info and pricing changes do not.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Submit to the Slack Marketplace (optional)
    The provider says
    Up to 6 weeks functional review for published apps resubmitting changes. [5]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Marketplace is the channel for commercial apps

Slack's 2025 API terms update says the Marketplace is the only appropriate channel for commercially distributing apps. Unlisted commercial apps get conversations.history and conversations.replies cut to 1 request per minute and 15 objects. [7]

Can get you bannedThe rules say

Do not train LLMs on Slack data

Marketplace AI apps must not use Slack data to train LLMs and must disclose model, retention and data residency. [6]

Can cost moneyThe rules say

Prohibited app behaviours

Exporting or backing up message data, bulk deletion, building third-party Slack clients, remote command execution, and financial/crypto/NFT transactions are not allowed in the Marketplace. [6]

Can cost moneyThe rules say

Long review queues

Functional review can take up to 10 weeks and cannot be expedited for launch dates; plan launches accordingly. [5]

Worth knowingThe rules say

Token rotation is one-way

Once token rotation is turned on it cannot be turned off; rotated access tokens expire after 12 hours. [2]

Worth knowingThe rules say

Internal apps are exempt from the new limits

Internal customer-built apps keep their higher rate limits. [7]

What you end up with

Env varSecretFormatWhat it is
SLACK_BOT_TOKENsecretxoxb-…Bot user OAuth token for the installed workspace
SLACK_SIGNING_SECRETsecretSigning secret used to verify requests from Slack
SLACK_CLIENT_IDnot secretApp client id for the OAuth install flow
SLACK_CLIENT_SECRETsecretApp client secret for the OAuth install flow
SLACK_APP_TOKENsecretxapp-…App-level token (only for Socket Mode and similar features)

Pricing

  • No fee to create or list an app is mentioned in the reviewed docs [to verify]. AI agent container apps need a paid Slack plan for users.

Source [6]

For agents

The same entry as JSON: /api/v1/entries/slack/app-and-directory · requirements /api/v1/requirements/slack/app-and-directory · terms /api/v1/terms/slack/app-and-directory.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Slack app and Slack Marketplace listing, and how long will it take?"
  → tools/call requirements { "provider_id": "slack/app-and-directory" }

Sources

  1. Slack - Quickstart (app settings) Create an app, choose development workspace, add scopes under OAuth & Permissions, Install to Workspace, access token shown under OAuth Tokens, reinstall after scope changes, keep token in env · accessed 25 October 2026 · official
  2. Slack - Tokens Token prefixes xoxb (bot), xoxp (user), xapp (app-level); rotated access tokens expire after 12 hours; rotation cannot be turned off once on · accessed 25 October 2026 · official
  3. Slack - Verifying requests from Slack Signing secret under Basic Info in the app admin panel; Client Secret can be regenerated in the admin panel · accessed 25 October 2026 · official
  4. Slack - Distributing your app Manage Distribution checklist, Activate Public Distribution, Add to Slack button, OAuth required for other workspaces, HTTPS required for all request URLs · accessed 25 October 2026 · official
  5. Slack Marketplace review guide 10+ active workspaces (used in past 28 days), fully functional and public, test credentials, video demo, scope checks, preliminary review up to 10 business days, functional review up to 10 weeks new / 6 weeks updates, cannot expedite, rejection reasons, re-review triggers, live app locked · accessed 25 October 2026 · official
  6. Slack Marketplace app guidelines and requirements Landing page, privacy policy contents, support within 2 business days, screenshots 1600x1000, short description 10 words, security requirements, prohibited behaviour, least-privilege scopes, AI app rules including no training LLMs on Slack data · accessed 25 October 2026 · official
  7. Slack changelog - Rate limit changes for non-Marketplace apps Updated API terms effective 29 May 2025 (new apps) / 30 June 2025 (older apps); Marketplace is the only appropriate channel for commercial distribution; internal apps not impacted; new limits for non-Marketplace apps · accessed 25 October 2026 · official
  8. Slack API - conversations.history Non-Marketplace commercially distributed apps limited to Tier 1 (1 request/minute) and 15 objects; existing installs subject from 3 March 2026; Marketplace and internal apps Tier 3 · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Slack (Salesforce) is not affiliated with verapli.