Skip to main content

oauth.access method

Facts​

DescriptionExchanges a temporary OAuth verifier code for an access token.
Method Access
POST https://slack.com/api/oauth.access
ScopesNo scopes required
Content types
application/x-www-form-urlencoded
application/json
Rate LimitsTier 4: 100+ per minute

Arguments​

Optional arguments

client_idstringOptional

Issued when you created your application. If possible, avoid sending client_id and client_secret as parameters in your request and instead supply the Client ID and Client Secret using the HTTP Basic authentication scheme.

Example: 2141029472.691202649728
client_secretstringOptional

Issued when you created your application. If possible, avoid sending client_id and client_secret as parameters in your request and instead supply the Client ID and Client Secret using the HTTP Basic authentication scheme.

Example: e1b9e11dfcd19c1982d5de12921e17e8c
codestringOptional

The code param returned via the OAuth callback.

Example: 4724469134.4644010092847.232b4e6d82c333b475fc30f5f5a341d294feb1a94392c2fd791f7ab7731a443d1a
redirect_uristringOptional

This must match the originally submitted URI (if one was sent).

Example: http://example.com
single_channelbooleanOptional

Request the user to add your app only to a single channel. Only valid with a legacy workspace app.

Default: false
Example: true

Usage info​

This is a legacy method only used by classic apps.

Use oauth.v2.access for granular permissions Slack apps

This method allows you to exchange a temporary OAuth code for an API access token.

This is the third step of the OAuth authentication flow.

We strongly recommend supplying the Client ID and Client Secret using the HTTP Basic authentication scheme, as discussed in RFC 6749.

If at all possible, avoid sending client_id and client_secret as parameters in your request.

Keep your tokens secure. Do not share tokens with users or anyone else.

When used with a legacy workspace app, this method's response differs significantly.

A potential gotcha: while redirect_uri is optional, it is required if your app passed it as a parameter to oauth/authorization in the first step of the OAuth flow.

Response​

Successful user token negotiation for a single scope

{
  "access_token": "xoxp-XXXXXXXX-XXXXXXXX-XXXXX",
  "scope": "groups:write",
  "team_name": "Wyld Stallyns LLC",
  "team_id": "TXXXXXXXXX",
  "enterprise_id": null
}

Success example when asking for multiple scopes, a bot user token, and an incoming webhook

{
  "access_token": "xoxp-XXXXXXXX-XXXXXXXX-XXXXX",