Interactions ▸ Chat channels ▸ Configuration
Connecting a Slack workspace lets Core dna post messages into your channels. It is used by AI agents in two ways: escalations are mirrored to a channel so somebody notices them, and report-style agents such as Sales Report deliver their output there.
This connection is outbound only. Core dna posts messages and reads your channel directory so the escalation channel picker can offer a list. It does not receive events, read message history, or respond to anything said in Slack.
What gets requested
| Permission | Why |
|---|---|
chat:write |
Posting messages. |
channels:read |
Listing public channels for the escalation channel picker. |
groups:read |
Listing private channels the bot has been added to, for the same picker. |
Before you start
You need the redirect URL, which is based on the admin host your client signs in through:
https://{your-admin-host}/cdna-admin/ChatChannels/slack/callback
It must match exactly: scheme, host and path. Slack rejects the install otherwise.
1. Create the Slack app
At https://api.slack.com/apps, choose Create New App.
From a manifest is fastest. Pick the workspace and paste this, replacing the redirect URL:
display_information:
name: Core dna
oauth_config:
redirect_urls:
- https://{your-admin-host}/cdna-admin/ChatChannels/slack/callback
scopes:
bot:
- chat:write
- channels:read
- groups:read
settings:
org_deploy_enabled: false
socket_mode_enabled: false
token_rotation_enabled: false
From scratch works too: name the app and pick the workspace, then under OAuth &
Permissions add the redirect URL, and add chat:write, channels:read and groups:read
under Scopes → Bot Token Scopes.
Either way, copy the Client ID and Client Secret from Basic Information → App Credentials.
You do not install the app from Slack's own admin UI, and you never copy a bot token by hand. Core dna obtains it automatically in step 3.
This step is done once per Slack app. Steps 2 and 3 are done once per Core dna client.
2. Enter the credentials in Core dna
On the Chat channels ▸ Configuration tab, fill in Client ID and Client secret from the Slack app, and save. Both are stored as protected settings.
3. Connect
On the Slack connection tab, choose Connect Slack workspace. Slack shows an authorize screen listing the three permissions; pick the workspace and approve.
You are returned to the admin with the workspace recorded. The tab then shows which workspace is connected, and offers Reconnect a different workspace.
4. Invite the bot to each channel
chat:write only allows posting to channels the bot has been added to. In Slack, open
each channel Core dna should post to and run:
/invite @YourAppName
Do this before selecting the channel on an agent install: a channel the bot has not joined will fail at posting time, not at selection time.
Upgrading an older connection
Workspaces connected before the channel picker shipped were authorised with chat:write
only. Their escalation channel dropdown stays empty, because listing channels needs
channels:read and groups:read.
Fix it by choosing Reconnect on the configuration page and re-approving. Slack re-issues the bot token with the new permissions. Nothing is lost.
Troubleshooting
| Symptom | Cause and fix |
|---|---|
invalid_state on return |
The OAuth handshake didn't match, usually a stale browser tab, or the install wasn't started in this session. Start again. |
exchange_failed |
Usually the redirect URL in the Slack app doesn't exactly match the callback route, or the client ID/secret are wrong. |
Posts fail with not_in_channel |
The bot isn't in that channel. Invite it (step 4). |
Escalation channel dropdown is empty, or missing_scope |
The connection predates the read scopes. Reconnect (see above). |
| "No Slack app client id/secret is configured" | Step 2 was never completed for this client. |