Skip to main content
Install the plugin, create the Slack app, and give OpenClaw the tokens it needs.

Install

plugins install registers and enables the plugin. It does nothing until you configure the Slack app and channel settings below. See Plugins for general plugin install rules.

Quick setup

The manifests in this section create a workspace-scoped installation. For an Enterprise Grid organization installation, use the dedicated org-wide manifest and workflow instead.
1

Create a new Slack app

Open api.slack.com/appsCreate New AppFrom a manifest → select your workspace → paste one of the manifests below → NextCreate.
Recommended matches the Slack plugin’s full feature set: App Home, slash commands, files, reactions, pins, group DMs, and emoji/usergroup reads. Pick Minimal when workspace policy restricts scopes — it covers DMs, channel/group history, mentions, and slash commands but drops files, reactions, pins, group-DM (mpim:*), emoji:read, and usergroups:read. See Manifest and scope checklist for per-scope rationale and additive options like extra slash commands.
After Slack creates the app:
  • Basic Information -> App-Level Tokens -> Generate Token and Scopes: add connections:write, save, copy the App-Level Token.
  • Install App -> Install to Workspace: copy the Bot User OAuth Token.
2

Configure OpenClaw

Recommended SecretRef setup:
Default-account credential fallback after channels.slack is configured:
3

Start gateway

User identity (post as a real person)

User identity lets OpenClaw read and post as the human who authorizes the Slack app. The userToken is the acting identity; a companion Slack app carries Events API traffic over Socket Mode or an HTTP Request URL. The companion app does not need a bot user or bot token. Set up the companion app as follows:
  1. Under OAuth & Permissions -> User Token Scopes, add these user-scoped permissions:
    • history: channels:history, groups:history, im:history, mpim:history
    • conversation lookup: channels:read, groups:read, im:read, mpim:read
    • people: users:read
    • posting: chat:write (messages are posted as the authorizing user)
    • opening DMs: im:write, mpim:write
  2. Under Event Subscriptions -> Subscribe to events on behalf of users, add these user events. Do not add them only to the bot-events list:
    • message.channels
    • message.groups
    • message.im
    • message.mpim
  3. Choose one event transport:
    • Socket Mode: enable Socket Mode and create an app-level token with connections:write. Configure it as appToken.
    • HTTP Request URL: point Event Subscriptions at the public OpenClaw Slack endpoint and copy Basic Information -> App Credentials -> Signing Secret. Configure it as signingSecret.
  4. Install or reinstall the app, authorize it as the intended human, and copy the resulting user OAuth token into userToken.
Socket Mode configuration:
HTTP Request URL configuration:
DMs and group DMs work only through the user-scope event subscription above. A bot cannot join a human 1:1 DM or be inserted into an existing group DM. The companion app is invisible plumbing: other Slack members see messages from the authorizing human, not from an OpenClaw bot.
OpenClaw automatically drops user-scope message events authored by the resolved human identity, so messages it sends do not trigger self-replies.

Token model

  • Bot identity (default) requires botToken + appToken for Socket Mode, or botToken + signingSecret for HTTP mode.
  • User identity requires userToken + appToken for Socket Mode, or userToken + signingSecret for HTTP mode. It does not use a bot token.
  • Relay mode requires botToken plus relay.url, relay.authToken, and relay.gatewayId; it does not use an app token or signing secret.
  • botToken, appToken, signingSecret, relay.authToken, and userToken accept plaintext strings or SecretRef objects.
  • Config tokens override env fallback.
  • SLACK_BOT_TOKEN, SLACK_APP_TOKEN, and SLACK_USER_TOKEN env fallback each apply only to the default account.
  • userToken defaults to read-only behavior (userTokenReadOnly: true).
Status snapshot behavior:
  • Slack account inspection tracks per-credential *Source and *Status fields (botToken, appToken, signingSecret, userToken).
  • Status is available, configured_unavailable, or missing.
  • configured_unavailable means the account is configured through SecretRef or another non-inline secret source, but the current command/runtime path could not resolve the actual value.
  • In HTTP mode, signingSecretStatus is included. Socket Mode uses botTokenStatus + appTokenStatus for bot identity and userTokenStatus + appTokenStatus for user identity.
For bot identity, actions and directory reads can prefer an optional user token; writes continue to use the bot token unless userTokenReadOnly: false allows fallback. For postAs: "user", reads and writes always use userToken.