Use your own Slack app is the Slack lane where the installed app belongs to your workspace, is created from Chickpea’s reviewed manifest, and talks directly to your deployment. Where Add to Slack installs Chickpea’s shared unlisted app through a private gateway, this lane asks you for a short-lived Slack configuration token, or for a manifest and app credentials you copy yourself. This page covers both paths, the Events URL verification that gates them, and what to do when Slack app creation returns an ambiguous result.
Prerequisites
- The private setup link for this deployment. It looks like
https://<your-deployment>/admin/setup#setup=<capability>, lasts 24 hours, and works only in the browser tab you opened it in. Chickpea removes the capability from the URL and keeps it in same-tab storage. - A Slack workspace where Slack lets you create and install apps. Slack’s own app-management policy decides that. Chickpea does not require you to hold Slack’s Owner or Admin role.
- The Slack account that should become Chickpea’s first Owner. Sign-in happens at the end of this page, and the OpenID Connect
team_idmust match the workspace the app was installed in. - A paid Slack plan and the user-group policy, if you want Agent handles. The manifest already requests
usergroups:readandusergroups:write, and no manifest field can grant the workspace policy. Ask a Slack Owner or Admin to open Roles & permissions → Account types → Create and edit user groups, allow Members, and save. That permits workspace members to manage user groups too, so disclose it before the change.
One deployment currently serves one Slack workspace. The team_id of the workspace you install into becomes that deployment’s immutable boundary.
What the manifest sets
Chickpea builds the manifest from your deployment’s own origin, so every URL below points at your deployment. The copy of the manifest in the product repo, slack-app-manifest.json, uses https://chickpea.example as a stand-in origin.
| Setting | Value |
|---|---|
| Events request URL | <origin>/channels/slack/events |
| Interactivity request URL | <origin>/channels/slack/interactions |
| Redirect URL, installation | <origin>/auth/slack/install/callback |
| Redirect URL, sign-in | <origin>/auth/slack/oidc/callback |
| Bot scopes | 20, listed in slack-app-manifest.json |
| User scopes | openid, profile, email |
| Bot events | 11, including app_mention, message.channels, and app_uninstalled |
| Socket Mode | Disabled |
| Token rotation | Disabled |
| Org-wide deploy | Disabled |
Do not use an app-level xapp- token. Chickpea uses Slack’s HTTP Events API and a bot token issued by the install flow.
Create the app with a configuration token
Open the customer-owned lane
Open the private setup link. On Add Chickpea to Slack, open Use your own Slack app instead.
Generate a Slack configuration token
In Slack, under Your App Configuration Tokens, choose Generate Token and select the workspace Chickpea will live in. Copy the access token, which begins xoxe.. Slack also shows a refresh token beginning xoxe-; Chickpea does not need it.
Create the app
Paste the access token into Slack configuration access token and choose Create my Slack app. Chickpea sends the token to Slack once, creates exactly one app from the reviewed manifest, and does not store the token. It keeps the returned client ID, client secret, and signing secret encrypted.
Continue with the installation and Events verification below.
Create the app without a configuration token
Use this path when Slack will not let you generate a configuration token. Under the token form, select Can’t create an app configuration token? Use guided manual setup. It opens /admin/setup/manual in the same tab.
Create the app in Slack
Choose Create Chickpea in Slack. Slack opens in a new tab with Chickpea’s manifest prefilled. Choose your workspace, select Next, review the app, and select Create and Install.
Finish in Slack
Review the requested permissions and select Allow. When Slack says Chickpea is ready, select Go to App Settings.
Copy the app credentials
Return to the Chickpea tab and choose Next: Add app credentials. In Slack’s Basic Information, copy the App ID, Client ID, Client Secret, and Signing Secret into the matching fields. The fourth value is the Signing Secret, not the Client Secret.
Paste the exported manifest and validate
Export the app manifest as JSON from Slack, paste it into Exported app manifest (JSON), and choose Validate and continue. Chickpea then returns you to /admin/setup.
If the app already exists, choose Already created the app? Add its credentials rather than creating a second one.
This form never accepts a bot token. Chickpea obtains the bot token from the install flow, and every secret field is write-only and encrypted before it is stored. A validation error clears all of them, so you paste the secrets again.
Validation compares your exported manifest against Chickpea’s on app name, bot display name, redirect URLs, bot and user scopes, the Events request URL and bot events, App Home, and interactivity. A mismatch is refused with Slack app manifest does not match the expected callbacks, scopes, or events. Restore the field Slack disagrees on and export again.
Install the app and verify Events
Both creation paths end here, on the setup page.
Install in the intended workspace
Choose Continue to Slack, pick the workspace, review the requested bot permissions, and select Allow. If your workspace requires app approval, request it, then return to the setup page and choose Resume Slack installation after approval.
Verify the Events URL
On Verify Slack Events, choose Check signed Events verification. If Slack has not delivered the challenge, open Event Subscriptions for the app, select Retry beside the Request URL, then select Save Changes, and check again.
Chickpea promotes the encrypted credential revision only after the OAuth result and a revision-bound signed Slack challenge agree on the same app and the same workspace. A challenge whose signature, app, or workspace does not match fails the installation instead of passing it.
Become the first Owner
On Become the first Owner, choose Sign in with Slack as the same Slack member who installed the app. Chickpea binds that Slack user_id as its first Owner. Installing the app alone grants no Chickpea access.
Recover an interrupted app creation
A network failure, an unreadable Slack response, or a Slack server error leaves the attempt ambiguous: Slack may have created the app anyway. The setup page then reads Choose the existing Slack app, and an attempt that has been pending for a minute is moved to the same state.
Verify
Signing in as the first Owner hands you the rest of the wizard: choose a model provider, choose a model, then Try Chickpea in Slack. That last step opens a direct message with Chickpea and waits for an answer.
Send one request in that DM. Chickpea marks setup complete only after a reply is delivered there to the Slack account that signed in. A verified Events URL on its own does not prove the app works.
On Node
Use this lane on Node. The shared gateway’s durable admission contract currently applies to Cloudflare deployments, and the Node target does not advertise durable admission to the gateway, so “Use your own Slack app” is the reliable Node ingress in v1. The steps above are otherwise the same on both targets.
Next steps
- In Slack: the rest of this section, including the two Slack app lanes and Slack troubleshooting.
- Get started on Cloudflare: the provider, model, and first-reply steps that follow Slack setup.
- Security: how Slack client, signing, and bot secrets are stored and recovered.