Install the Slack communication channel with Builder CLI. Builder creates or updates the Slack app from the generated manifest and stores credentials, then leaves only Slack-owned workspace consent when Slack asks.
Users state a business goal in Slack. AI Fabrix Role Assistants return a governed result, question, or completed outcome. Slack does not execute enterprise work or grant authority. See Conversation-first work.
Prerequisites
- Deliver assistant channels hub read
aifabrix loginand developer workstation ready- Slack workspace admin available for app approval
- Public HTTPS dataplane URL (Slack cannot reach localhost callbacks)
Where it lives
| Artifact | Location |
|---|---|
| Local scaffold | integration/slack/ after channel add |
| Published system | Connected System after upload |
| Channel branding | --name on channel add (environment-scoped display) |
| Secrets | Authentication / kv:// — never in generated files |
Slack is a Connected System with systemKind: communication. The dataplane serves inbound events and slash commands; Role Assistants attach to the same governed catalog as the portal — not a separate automation stack.
How to set
aifabrix channel add slack --name "Elsa"
Builder scaffolds and publishes the Slack Connected System when needed, generates the Slack app manifest, creates or updates the Slack app, and stores the bot token and signing secret. If Slack CLI is missing, the command asks Install Slack CLI now? and runs Slack’s official installer when you confirm, then offers Sign in to Slack now? (slack login).
A successful run prints Slack: Connected. You do not paste tokens.
When the run does not print Slack: Connected., complete Slack-owned steps in this order. The CLI prints the filled URLs for your app — use those, do not reconstruct them:
- Open Slack app — upload your logo on Basic Information (
/general). - Activate the application — open the Activate URL the CLI prints, then approve the workspace install. That adds the app. Do not use Slack’s Install App page (
/install-on-team). - If Authentication still needs values, copy Signing Secret and Bot User OAuth Token from the Slack app into the Authentication tab the CLI prints.
Do not put client secrets in manifests or chat. Slack HMAC inbound does not use an OAuth redirect URL.
The command may ask Onboard users? Yes matches Slack profile email to an existing platform user email. Unmatched people still use Link account. Scripts: --onboard-users or --no-onboard-users. --force does not re-onboard unless you pass --onboard-users or answer yes again.
Optional Slack slash-command prefix (registers /{prefix}-help and related commands in the manifest):
aifabrix channel add slack --name "Elsa" --command-prefix af --probe
--force refreshes the local package and Slack app manifest. It does not rotate working credentials or create a second Slack app.
If Slack CLI is missing or callbacks are not public HTTPS, Builder keeps the generated manifest. On an interactive terminal it asks to install Slack CLI (official installer, not the Slack desktop app). If you decline, it prints remaining Slack steps.
If manifest sections drift after manual edits, run aifabrix repair slack before re-upload — same repair pattern as other Connected Systems.
Defaults and examples
| Setting | Typical value |
|---|---|
| Target key | slack |
| Inbound auth | hmac (signature + timestamp headers) |
| Signature header | X-Slack-Signature |
| Timestamp header | X-Slack-Request-Timestamp |
| Secrets | kv://slack/signingSecret and kv://slack/botToken — never in generated files |
--name |
Customer-visible brand (for example Elsa) |
--command-prefix |
af unless your workspace needs another alias |
Do not create one Slack app per Assistant. One Slack channel install serves many Assistants.
Inbound validation layers
| Layer | Slack-specific check |
|---|---|
| Installation auth | Workspace admin approves app scopes |
| Inbound validation | HMAC signature + timestamp replay window |
| End-user identity | Map Slack user ID to enterprise identity before business data |
Validate
aifabrix channel add slack --name "Elsa" --probe
Confirm: Slack: Connected.; replay/timestamp protection enabled; callbacks reachable; Assistant catalog reachable; no plaintext secrets in artifacts. Admin completes Connect assistant channels.
Probe failures often trace to a missing workspace install or wrong callback URL — fix those Slack-owned steps, not Assistant definitions.
Common mistakes
| Mistake | Fix |
|---|---|
deploy slack or app add-channel |
Use aifabrix channel add slack --name "Elsa" |
| Skipping Slack CLI login | Run slack login for the workspace that should own the app |
| Skipping the Activate URL | Open the Activate the application URL the CLI prints, then approve. Do not use /install-on-team. |
| Skipping the app icon | Upload your logo on the Slack app General page (/apps/<appId>/general) |
| Using localhost callbacks | Slack needs a public HTTPS dataplane URL |
| One Slack app per role | Single channel; many Assistants |
| Secrets pasted into integration JSON | kv:// only — Builder stores them on the normal path |
Limits
Provider approval and scope policies vary by workspace. Slack CLI must be installed for the automated path. Signing secret is returned only when Slack creates the app; later updates cannot re-read it. Meeting and voice are not Slack channel-install features. Confirm slash-command prefix availability with workspace policy before production.