to_i slack_signature = request.headers raise 'Validation Error ' unless timestamp.present? & slack_signature.present? head :unauthorized if request_too_old? (timestamp ) body = sig_basestring = ' v0: # &redirect_uri='%> You can read up on it here or just use this example implementation: # use this as a before_action in your controller def validate_slack_token timestamp = request.headers. There is a very specific recipe for verifying that a request came from Slack where you concatenate the timestamp and the request body, and then sign it with your secret, and then check the results. In order to make sure a request your server got is from Slack and not some random attacker, Slack will include two important headers: X-Slack-Request-Timestamp and X-Slack-Signature in all their HTTP requests.

It’s a good security practice to place these in environment variables, not in the code, and absolutely make sure they don’t reach your remote repository! The Client ID is embedded in the “Add to Slack” button. It might sound counter-intuitive, but when a team installs your app, you will have to use this id-secret combination to fetch their specific OAuth token, which you will use in later communications about that team. You can read more about this here, later.īoth the Client ID and Client Secret are used when communicating with Slack’s backend about stuff that’s not in the context of a specific team. The app ID is used to help Slack suggest your bot when a link to your domain is shared in a conversation.

Slack app