Exposed Slack Token? Here's how to detect and rotate it

A Slack token (bot tokens start with xoxb-, user tokens with xoxp-) authenticates API calls to your workspace with whatever scopes the app was granted. Anyone holding it can act as your app or user — reading channels, posting messages, and pulling data — until you revoke it. Without token rotation these tokens do not expire, so a leak stays exploitable indefinitely.

What an attacker can do with a leaked Slack Token

• Reads messages, files, and channel history the token's scopes allow, exfiltrating internal data.
• Posts messages or DMs as your bot or user to phish coworkers or push malicious links.
• Enumerates users, channels, and workspace details to map your org for further attacks.
• Abuses admin or write scopes to invite users, change settings, or delete content.

How Slack Tokens get exposed

• Committed to a public repo in a .env file, config, or CI workflow.
• Hardcoded in a bot script, serverless function, or Dockerfile that got shared.
• Exposed in application logs, an error report, or a screenshot of a config screen.
• Pasted into a chat, ticket, or forum post while debugging an integration.

How to rotate a leaked Slack Token

1. Go to api.slack.com/apps and open the affected app.
2. Select OAuth & Permissions in the left menu, scroll to Revoke All OAuth Tokens, and click Revoke tokens to kill the leaked xoxb-/xoxp- token immediately.
3. Scroll back up to OAuth Tokens and click Reinstall to (your workspace) to generate a fresh token.
4. Copy the new token and update your server environment or secrets manager, then redeploy.
5. While you are there, trim Bot/User Token Scopes to the minimum your app actually needs.
6. Check your workspace admin audit logs (Enterprise/Business+) or the app's activity for unexpected posts or API calls during the exposure window.

Open the Slack Token dashboard →