Skip to Content
How-to guidesUse your own Slack app

Use your own Slack app

Run Slack on an app your org owns. The consent screen shows your app name, every token comes from your app, and you can revoke it from your own Slack workspace. Your security review gets the control it asks for, and your team keeps answering agents from Slack as before.

Before you start

  • Role: admin or owner in Marshal. In Slack, you need permission to create an app in the workspace.
  • Available when your administrator enables Slack.
  • With your own Slack app in use, Slack works without Marshal’s Auth Broker.

Steps

Create the Slack app from a manifest

The fastest route is the Own app panel. It shows a manifest built for your organization, with the redirect URL for your Marshal address filled in, plus Copy manifest and Create in Slack.

  1. In Marshal, open Organization settings, then OAuth apps, find the Slack row, select Configure, and choose Own app. The Slack row appears on OAuth apps once the Slack MCP package is installed.
  2. In the panel, select Create in Slack. Slack opens with the manifest filled in. Pick your workspace and select Create. Or select Copy manifest, then in api.slack.com/apps  choose Create New App, From an app manifest, and paste it.

Prefer to start from a static copy? Open api.slack.com/apps , select Create New App, then From an app manifest, pick your workspace, and paste the manifest below. Replace <your org> with your organization name and <your-marshal-host> with the host you open Marshal on. Select Create.

display_information:
  name: Marshal (<your org>)
  description: Questions, approvals and notices from your Marshal agents.
features:
  bot_user:
    display_name: Marshal
    always_online: false
oauth_config:
  redirect_urls:
    - https://<your-marshal-host>/api/auth/callback/slack-direct
  scopes:
    bot:
      - chat:write
      - im:write
      - users:read
      - users:read.email
      - channels:read
      - groups:read
      - chat:write.customize
    user:
      - chat:write
      - channels:history
      - groups:history
      - im:history
      - mpim:history
      - users:read
      - users:read.email
      - search:read.public
      - search:read.private
      - search:read.im
      - search:read.mpim
      - search:read.files
      - search:read.users
      - canvases:read
      - canvases:write
settings:
  interactivity:
    is_enabled: false
  org_deploy_enabled: false
  socket_mode_enabled: false
  token_rotation_enabled: false
  is_mcp_enabled: true

The manifest asks for the bot scopes Marshal uses to message your team, including posting a deputy’s questions to a channel you pick under the deputy’s own name, and the user scopes members use for Slack MCP. It turns on Slack MCP for the app and leaves Socket Mode and Event Subscriptions off. Interactivity stays off until you add the URL in “Add the interactivity URL” below. Marshal then receives button clicks and approvals through Interactivity.

Give Marshal the app

  1. In Marshal, open the organization menu in the top bar and choose Organization settings, then OAuth apps.
  2. Find the Slack row and select Own app in the connect mode toggle. Until your app is in use, the mode reads Own app Set up (or Own app Manage once you saved one), and selecting it opens the Own app panel.
  3. In the Own app panel, enter the Client ID and Client secret, and the Signing secret. All three are on Basic Information in your Slack app. The signing secret is at least 32 characters, and Slack generates it. Select Save. Marshal stores the secrets encrypted and never shows them again.
  4. Check that the Redirect URI on the row matches the redirect URL in your Slack app: https://<your-marshal-host>/api/auth/callback/slack-direct.
  5. Select Test connection. When it passes, the panel says Verified. You can enable this app now.
  6. Select Enable. The badge changes to Enabled.

Connect Slack

  1. Open Organization settings, then Slack.
  2. Select Connect Slack. Slack shows the consent screen for your app. Approve it.
  3. You return to Marshal and the card shows Connected.

Add the interactivity URL

  1. On the same Slack page, find the Slack delivery card and copy the Interactivity URL.
  2. In your Slack app, open Interactivity & Shortcuts, switch Interactivity on, paste the URL into Request URL, and save.

The card shows Last event and Refused events, so you can see Slack reaching Marshal. It reads Active after the first click arrives.

Members connect Slack MCP

Members connect through the same app. They open Connections, find Slack MCP, and select Connect with Slack (personal). The consent screen shows your app, and their tokens come from it. Connections made before you switched keep working until people reconnect.

What you should see

  • The Own app panel shows Enabled and Client and signing secrets saved.
  • The Slack page shows Connected, and Using your own Slack app.
  • A button in a message from your Slack app reaches Marshal, and Last event shows its time.

Rotate the signing secret

Change the signing secret in your Slack app, then open the Own app panel and select Rotate. Enter the new Signing secret and select Save. The new secret takes effect at once.

Switch back to Marshal’s app

On the Slack row, choose Marshal app in the toggle. Slack connects through Marshal’s app from then on, and your own app stays saved. Select Disable in the panel when you want your app to stop receiving Slack requests.

If you disable your own app while Own app is chosen, Slack stays on Own app and connecting pauses until you enable the app again or choose another mode.

Next

Answer a question from a run: see an approval arrive in Slack and resume the run.

Connect SlackUse your own GitHub App