Install
plugins install registers and enables the plugin. It does nothing until you configure the Slack app and channel settings below. See Plugins for general plugin install rules.
Quick setup
The manifests in this section create a workspace-scoped installation. For an Enterprise Grid organization installation, use the dedicated org-wide manifest and workflow instead.- Socket Mode (default)
- HTTP Request URLs
1
Create a new Slack app
Open api.slack.com/apps → Create New App → From a manifest → select your workspace → paste one of the manifests below → Next → Create.After Slack creates the app:
Recommended matches the Slack plugin’s full feature set: App Home, slash commands, files, reactions, pins, group DMs, and emoji/usergroup reads. Pick Minimal when workspace policy restricts scopes — it covers DMs, channel/group history, mentions, and slash commands but drops files, reactions, pins, group-DM (
mpim:*), emoji:read, and usergroups:read. See Manifest and scope checklist for per-scope rationale and additive options like extra slash commands.- Basic Information -> App-Level Tokens -> Generate Token and Scopes: add
connections:write, save, copy the App-Level Token. - Install App -> Install to Workspace: copy the Bot User OAuth Token.
2
Configure OpenClaw
Recommended SecretRef setup:Default-account credential fallback after
channels.slack is configured:3
Start gateway
User identity (post as a real person)
User identity lets OpenClaw read and post as the human who authorizes the Slack app. TheuserToken is the acting identity; a companion Slack app carries Events API traffic over Socket Mode or an HTTP Request URL. The companion app does not need a bot user or bot token.
Set up the companion app as follows:
-
Under OAuth & Permissions -> User Token Scopes, add these user-scoped permissions:
- history:
channels:history,groups:history,im:history,mpim:history - conversation lookup:
channels:read,groups:read,im:read,mpim:read - people:
users:read - posting:
chat:write(messages are posted as the authorizing user) - opening DMs:
im:write,mpim:write
- history:
-
Under Event Subscriptions -> Subscribe to events on behalf of users, add these user events. Do not add them only to the bot-events list:
message.channelsmessage.groupsmessage.immessage.mpim
-
Choose one event transport:
- Socket Mode: enable Socket Mode and create an app-level token with
connections:write. Configure it asappToken. - HTTP Request URL: point Event Subscriptions at the public OpenClaw Slack endpoint and copy Basic Information -> App Credentials -> Signing Secret. Configure it as
signingSecret.
- Socket Mode: enable Socket Mode and create an app-level token with
-
Install or reinstall the app, authorize it as the intended human, and copy the resulting user OAuth token into
userToken.
Token model
- Bot identity (default) requires
botToken+appTokenfor Socket Mode, orbotToken+signingSecretfor HTTP mode. - User identity requires
userToken+appTokenfor Socket Mode, oruserToken+signingSecretfor HTTP mode. It does not use a bot token. - Relay mode requires
botTokenplusrelay.url,relay.authToken, andrelay.gatewayId; it does not use an app token or signing secret. botToken,appToken,signingSecret,relay.authToken, anduserTokenaccept plaintext strings or SecretRef objects.- Config tokens override env fallback.
SLACK_BOT_TOKEN,SLACK_APP_TOKEN, andSLACK_USER_TOKENenv fallback each apply only to the default account.userTokendefaults to read-only behavior (userTokenReadOnly: true).
- Slack account inspection tracks per-credential
*Sourceand*Statusfields (botToken,appToken,signingSecret,userToken). - Status is
available,configured_unavailable, ormissing. configured_unavailablemeans the account is configured through SecretRef or another non-inline secret source, but the current command/runtime path could not resolve the actual value.- In HTTP mode,
signingSecretStatusis included. Socket Mode usesbotTokenStatus+appTokenStatusfor bot identity anduserTokenStatus+appTokenStatusfor user identity.