How To Get Slack Token for Bot API, User Token & API Key

https://slack.com/oauth/v2/authorize?


client_id=YOUR_CLIENT_ID&
scope=chat:write,channels:read&
user_scope=users:read&
redirect_uri=[https://yourapp.com/slack/oauth](https://yourapp.com/slack/oauth)

const response = await fetch('https://slack.com/api/oauth.v2.access', {


method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({
client_id: process.env.SLACK_CLIENT_ID,
client_secret: process.env.SLACK_CLIENT_SECRET,
code: receivedCode,
redirect_uri: '[https://yourapp.com/slack/oauth](https://yourapp.com/slack/oauth)'
})
});

const data = await response.json();
const botToken = data.access_token; // xoxb-...
const userToken = data.authed_user?.access_token; // xoxp-...

const crypto = require('crypto');


function verifySlackRequest(req, signingSecret) {
const timestamp = req.headers['x-slack-request-timestamp'];
const slackSignature = req.headers['x-slack-signature'];

// Prevent replay attacks
const fiveMinutesAgo = Math.floor(Date.now() / 1000) - (60 * 5);
if (timestamp < fiveMinutesAgo) {
return false;
}

// Create basestring: v0:timestamp:body
const baseString = `v0:${timestamp}:${req.rawBody}`;

// Calculate HMAC-SHA256 signature
const hmac = crypto.createHmac('sha256', signingSecret);
hmac.update(baseString);
const computedSignature = 'v0=' + hmac.digest('hex');

// Use timing-safe comparison
return crypto.timingSafeEqual(
Buffer.from(computedSignature),
Buffer.from(slackSignature)
);
}