forked from slackapi/python-slack-sdk
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathauth.html
More file actions
251 lines (226 loc) · 20.5 KB
/
auth.html
File metadata and controls
251 lines (226 loc) · 20.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Tokens & Authentication — Slack Developer Kit for Python</title>
<link rel="stylesheet" href="https://a.slack-edge.com/b143/style/plastic_helpers.css" type="text/css"/>
<link rel="stylesheet" href="https://a.slack-edge.com/58b24/style/plastic_typography.css" type="text/css" />
<link rel="stylesheet" href="https://a.slack-edge.com/b900/style/plastic_layout.css" type="text/css" />
<link rel="stylesheet" href="https://a.slack-edge.com/2133/style/plastic_grid.css" type="text/css" />
<link rel="stylesheet" href="https://a.slack-edge.com/be9e/style/plastic_buttons.css" type="text/css" />
<link rel="stylesheet" href="https://a.slack-edge.com/1d9c/style/libs/lato-1-compressed.css" type="text/css" />
<link rel="stylesheet" href="./_static/default.css" type="text/css" />
<link rel="stylesheet" href="./_static/pygments.css" type="text/css" />
<link id="favicon" rel="shortcut icon" href="https://a.slack-edge.com/66f9/img/icons/favicon-32.png" type="image/png" />
<link rel="top" title="Slack Developer Kit for Python 1.0.1 documentation" href="index.html" />
</head>
<body class="api light_theme">
<header>
<a id="menu_toggle" class="no_transition show_on_mobile">
<span class="menu_icon"></span>
<span class="vert_divider"></span>
</a>
<a href="https://api.slack.com/" id="header_logo" class="api hide_on_mobile" style="float:left; display: inline-block;">
<img alt="Slack API" src="https://a.slack-edge.com/ae57/img/slack_api_logo.png" style="width: 225px; padding-right: 25px; border-right: 1px solid #DDD;"/>
</a>
<span style="display: inline-block; padding-left: 20px; margin-top: 20px; font-weight: bold;">
<a style="color: #555459;" href="./index.html">Slack Developer Kit for Python</a>
</span>
<div class="header_nav">
<a href="https://github.com/SlackAPI/python-slackclient" class="btn header_btn float_right" data-qa="go_to_slack">Go to GitHub</a>
</div>
</header>
<div id="page">
<div id="page_contents" class="clearfix">
<!-- Sidebar Content -->
<nav id="api_nav" class="col span_1_of_4">
<div id="api_sections">
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="index.html">Slack Developer Kit for Python</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Tokens & Authentication</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#handling-tokens-and-other-sensitive-data">Handling tokens and other sensitive data</a></li>
<li class="toctree-l2"><a class="reference internal" href="#test-tokens">Test Tokens</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-oauth-flow">The OAuth flow</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="basic_usage.html">Basic Usage</a><ul>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#sending-a-message">Sending a message</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#replying-to-messages-and-creating-threads">Replying to messages and creating threads</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#updating-the-content-of-a-message">Updating the content of a message</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#deleting-a-message">Deleting a message</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#adding-or-removing-an-emoji-reaction">Adding or removing an emoji reaction</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#getting-a-list-of-channels">Getting a list of channels</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#getting-a-channel-s-info">Getting a channel’s info</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#joining-a-channel">Joining a channel</a></li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#leaving-a-channel">Leaving a channel</a></
8000
li>
<li class="toctree-l2"><a class="reference internal" href="basic_usage.html#get-a-list-of-team-members">Get a list of team members</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="real_time_messaging.html">Real Time Messaging</a><ul>
<li class="toctree-l2"><a class="reference internal" href="real_time_messaging.html#connecting-to-the-real-time-messaging-api">Connecting to the Real Time Messaging API</a></li>
<li class="toctree-l2"><a class="reference internal" href="real_time_messaging.html#rtm-events">RTM Events</a></li>
<li class="toctree-l2"><a class="reference internal" href="real_time_messaging.html#sending-messages-via-the-rtm-api">Sending messages via the RTM API</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="faq.html">Frequently Asked Questions</a><ul>
<li class="toctree-l2"><a class="reference internal" href="faq.html#what-even-is-product-name-and-why-should-i-care">What even is Slack Developer Kit for Python and why should I care?</a></li>
<li class="toctree-l2"><a class="reference internal" href="faq.html#omg-i-found-a-bug">OMG I found a bug!</a></li>
<li class="toctree-l2"><a class="reference internal" href="faq.html#hey-there-s-a-feature-missing">Hey, there’s a feature missing!</a></li>
<li class="toctree-l2"><a class="reference internal" href="faq.html#i-d-like-to-contribute-but-how">I’d like to contribute...but how?</a></li>
<li class="toctree-l2"><a class="reference internal" href="faq.html#how-do-i-compile-the-documentation">How do I compile the documentation?</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="changelog.html">Changelog</a><ul>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v1-0-4-2016-12-15">v1.0.4 (2016-12-15)</a></li>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v1-0-3-2016-12-13">v1.0.3 (2016-12-13)</a></li>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v1-0-2-2016-09-22">v1.0.2 (2016-09-22)</a></li>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v1-0-1-2016-03-25">v1.0.1 (2016-03-25)</a></li>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v1-0-0-2016-02-28">v1.0.0 (2016-02-28)</a></li>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v0-18-0-2016-02-21">v0.18.0 (2016-02-21)</a></li>
<li class="toctree-l2"><a class="reference internal" href="changelog.html#v0-17-2016-02-15">v0.17 (2016-02-15)</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="about.html">About</a><ul>
<li class="toctree-l2"><a class="reference internal" href="about.html#product-name">Slack Developer Kit for Python</a></li>
</ul>
</li>
</ul>
<div id="footer">
<ul id="footer_nav">
<li><a href="https://github.com/SlackAPI/python-slackclient/blob/master/LICENSE">License</a></li>
<li><a href="https://github.com/SlackAPI/python-slackclient/blob/master/CODE_OF_CONDUCT.md">Code of Conduct</a></li>
<li><a href="https://github.com/SlackAPI/python-slackclient/blob/master/CONTRIBUTING.md">Contributing</a></li>
<li><a href="https://docs.google.com/a/slack-corp.com/forms/d/e/1FAIpQLSfzjVoCM7ohBnjWf7eDYQxzti1EPpinsIJQA5RAUBwJKRUQHg/viewform">Contributor License Agreement</a></li>
</ul>
<p id="footer_signature">Made with <i class="ts_icon ts_icon_heart"></i> by Slack<br/>and our Lovely
Community
</p>
</div>
</div>
</nav>
<!-- /Sidebar Content -->
<!-- Body Content -->
<div class="col span_3_of_4">
<div class="section-title">Tokens & Authentication</div>
<div class="card">
<div class="section" id="tokens-authentication">
<h1>Tokens & Authentication<a class="headerlink" href="#tokens-authentication" title="Permalink to this headline">¶</a></h1>
<div class="section" id="handling-tokens-and-other-sensitive-data">
<span id="handling-tokens"></span><h2>Handling tokens and other sensitive data<a class="headerlink" href="#handling-tokens-and-other-sensitive-data" title="Permalink to this headline">¶</a></h2>
<p>Slack tokens are the keys to your—or your customers’—teams. Keep them secret. Keep them safe. One way to do that is to never explicitly hardcode them.</p>
<p>Try to avoid this when possible:</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="n">token</span> <span class="o">=</span> <span class="s1">'xoxb-abc-1232'</span>
</pre></div>
</div>
<p>If you commit this code to GitHub, the world gains access to this token’s team. Rather, we recommend you pass tokens in as environment variables, or persist them in a database that is accessed at runtime. You can add a token to the environment by starting your app as:</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="n">SLACK_BOT_TOKEN</span><span class="o">=</span><span class="s2">"xoxb-abc-1232"</span> <span class="n">python</span> <span class="n">myapp</span><span class="o">.</span><span class="n">py</span>
</pre></div>
</div>
<p>Then in your code retrieve the key with:</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">os</span>
<span class="n">SLACK_BOT_TOKEN</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">"SLACK_BOT_TOKEN"</span><span class="p">]</span>
</pre></div>
</div>
<p>You can use the same technique for other kinds of sensitive data that ne’er-do-wells could use in nefarious ways, including</p>
<ul class="simple">
<li>Incoming webhook URLs</li>
<li>Slash command verification tokens</li>
<li>App client ids and client secrets</li>
</ul>
<p>For additional information, please see our <a class="reference external" href="https://api.slack.com/docs/oauth-safety">Safely Storing Credentials</a> page.</p>
</div>
<div class="section" id="test-tokens">
<h2>Test Tokens<a class="headerlink" href="#test-tokens" title="Permalink to this headline">¶</a></h2>
<p>During development (prior to implementing OAuth) you can use a test token provided by the <a class="reference external" href="https://api.slack.com/docs/oauth-test-tokens">Test Token Generator</a>. These tokens provide access to your private data and that of your team.</p>
<p><strong>Tester tokens are not intended to replace OAuth 2.0 tokens.</strong> Once your app is ready for users, replace this token with a proper OAuth token implementation.</p>
<p><strong>Never share test tokens with other users or applications. Do not publish test tokens in public code repositories.</strong></p>
</div>
<div class="section" id="the-oauth-flow">
<h2>The OAuth flow<a class="headerlink" href="#the-oauth-flow" title="Permalink to this headline">¶</a></h2>
<p>Authentication for Slack’s APIs is done using OAuth, so you’ll want to read up on <a class="reference external" href="https://api.slack.com/docs/oauth">OAuth</a>.</p>
<p>In order to implement OAuth in your app, you will need to include a web server. In this example, we’ll use <a class="reference external" href="http://flask.pocoo.org/">Flask</a>.</p>
<p>As mentioned above, we’re setting the app tokens and other configs in environment variables and pulling them into global variables.</p>
<p>Depending on what actions your app will need to perform, you’ll need different OAuth permission scopes. Review the available scopes <a class="reference external" href="https://api.slack.com/docs/oauth-scopes">here</a>.</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">os</span>
<span class="kn">from</span> <span class="nn">flask</span> <span class="kn">import</span> <span class="n">Flask</span><span class="p">,</span> <span class="n">request</span>
<span class="kn">from</span> <span class=&quo
8000
t;nn">slackclient</span> <span class="kn">import</span> <span class="n">SlackClient</span>
<span class="n">client_id</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">"SLACK_CLIENT_ID"</span><span class="p">]</span>
<span class="n">client_secret</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">"SLACK_CLIENT_SECRET"</span><span class="p">]</span>
<span class="n">oauth_scope</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">"SLACK_BOT_SCOPE"</span><span class="p">]</span>
<span class="n">app</span> <span class="o">=</span> <span class="n">Flask</span><span class="p">(</span><span class="n">__name__</span><span class="p">)</span>
</pre></div>
</div>
<p><strong>The OAuth initiation link:</strong></p>
<p>To begin the OAuth flow, you’ll need to provide the user with a link to Slack’s OAuth page,
This directs the user to Slack’s OAuth acceptance page, where the user will review and accept
or refuse the permissions your app is requesting as defined by the requested scope(s).</p>
<p>For the best user experience, use the <a class="reference external" href="https://api.slack.com/docs/slack-button">Add to Slack button</a> to direct users to approve your application for access or <a class="reference external" href="https://api.slack.com/docs/sign-in-with-slack">Sign in with Slack</a> to log users in.</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="nd">@app.route</span><span class="p">(</span><span class="s2">"/begin_auth"</span><span class="p">,</span> <span class="n">methods</span><span class="o">=</span><span class="p">[</span><span class="s2">"GET"</span><span class="p">])</span>
<span class="k">def</span> <span class="nf">pre_install</span><span class="p">():</span>
<span class="k">return</span> <span class="s1">'''</span>
<span class="s1"> <a href="https://slack.com/oauth/authorize?scope={0}&client_id={1}"></span>
<span class="s1"> Add to Slack</span>
<span class="s1"> </a></span>
<span class="s1"> '''</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">oauth_scope</span><span class="p">,</span> <span class="n">client_id</span><span class="p">)</span>
</pre></div>
</div>
<p><strong>The OAuth completion page</strong></p>
<p>Once the user has agreed to the permissions you’ve requested on Slack’s OAuth
page, Slack will redirect the user to your auth completion page. Included in this
redirect is a <code class="docutils literal"><span class="pre">code</span></code> query string param which you’ll use to request access
tokens from the <code class="docutils literal"><span class="pre">oauth.access</span></code> endpoint.</p>
<p>Generally, Web API requests require a valid OAuth token, but there are a few endpoints
which do not require a token. <code class="docutils literal"><span class="pre">oauth.access</span></code> is one example of this. Since this
is the endpoint you’ll use to retrieve the tokens for later API requests,
an empty string <code class="docutils literal"><span class="pre">""</span></code> is acceptable for this request.</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="nd">@app.route</span><span class="p">(</span><span class="s2">"/finish_auth"</span><span class="p">,</span> <span class="n">methods</span><span class="o">=</span><span class="p">[</span><span class="s2">"GET"</span><span class="p">,</span> <span class="s2">"POST"</span><span class="p">])</span>
<span class="k">def</span> <span class="nf">post_install</span><span class="p">():</span>
<span class="c1"># Retrieve the auth code from the request params</span>
<span class="n">auth_code</span> <span class="o">=</span> <span class="n">request</span><span class="o">.</span><span class="n">args</span><span class="p">[</span><span class="s1">'code'</span><span class="p">]</span>
<span class="c1"># An empty string is a valid token for this request</span>
<span class="n">sc</span> <span class="o">=</span> <span class="n">SlackClient</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
<span class="c1"># Request the auth tokens from Slack</span>
<span class="n">auth_response</span> <span class="o">=</span> <span class="n">sc</span><span class="o">.</span><span class="n">api_call</span><span class="p">(</span>
<span class="s2">"oauth.access"</span><span class="p">,</span>
<span class="n">client_id</span><span class="o">=</span><span class="n">client_id</span><span class="p">,</span>
<span class="n">client_secret</span><span class="o">=</span><span class="n">client_secret</span><span class="p">,</span>
<span class="n">code</span><span class="o">=</span><span class="n">auth_code</span>
<span class="p">)</span>
</pre></div>
</div>
<p>A successful request to <code class="docutils literal"><span class="pre">oauth.access</span></code> will yield two tokens: A <code class="docutils literal"><span class="pre">user</span></code>
token and a <code class="docutils literal"><span class="pre">bot</span></code> token. The <code class="docutils literal"><span class="pre">user</span></code> token <code class="docutils literal"><span class="pre">auth_response['access_token']</span></code>
is used to make requests on behalf of the authorizing user and the <code class="docutils literal"><span class="pre">bot</span></code>
token <code class="docutils literal"><span class="pre">auth_response['bot']['bot_access_token']</span></code> is for making requests
on behalf of your app’s bot user.</p>
<p>If your Slack app includes a bot user, upon approval the JSON response will contain
an additional node containing an access token to be specifically used for your bot
user, within the context of the approving team.</p>
<p>When you use Web API methods on behalf of your bot user, you should use this bot
user access token instead of the top-level access token granted to your application.</p>
<div class="highlight-python"><div class="highlight"><pre><span></span><span class="c1"># Save the bot token to an environmental variable or to your data store</span>
<span class="c1"># for later use</span>
<span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">"SLACK_USER_TOKEN"</span><span class="p">]</span> <span class="o">=</span> <span class="n">auth_response</span><span class="p">[</span><span class="s1">'access_token'</span><span class="p">]</span>
<span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">[</span><span class="s2">"SLACK_BOT_TOKEN"</span><span class="p">]</span> <span class="o">=</span> <span class="n">auth_response</span><span class="p">[</span><span class="s1">'bot'</span><span class="p">][</span><span class="s1">'bot_access_token'</span><span class="p">]</span>
<span class="c1"># Don't forget to let the user know that auth has succeeded!</span>
<span class="k">return</span> <span class="s2">"Auth complete!"</span>
</pre></div>
</div>
<p>Once your user has completed the OAuth flow, you’ll be able to use the provided
tokens to make a variety of Web API calls on behalf of the user and your app’s bot user.</p>
<p>See the <a class="reference internal" href="basic_usage.html#web-api-examples"><span class="std std-ref">Web API usage</span></a> section of this documentation for usage examples.</p>
</div>
</div>
<div class="clear_both large_bottom_margin"></div>
</div>
</div>
<!-- /Body Content -->
</div>
</div>
<footer>
<p class="light tiny align_center">Copyright © 2015–2016 Slack Technologies, Inc. and contributors</p>
</footer>
<script type="text/javascript" src="https://a.slack-edge.com/1504/js/rollup-core_required_libs.js" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://a.slack-edge.com/125e0/js/rollup-core_web.js" crossorigin="anonymous"></script>
</body>
</html>