如何获取Slack用户Token以调用users.setPresence接口修改在线状态

Hey there, let's walk through the legitimate ways to obtain user tokens for modifying multiple users' presence via Slack's users.setPresence endpoint—keep in mind Slack enforces strict security rules, so all methods below align with their guidelines and terms of service:

1. User OAuth Tokens (Recommended Method) #

This is the standard, secure way to get user-specific tokens for your app:

• First, create a Slack app in your workspace or enterprise.
• Add the required scopes to your app: users:write (mandatory for modifying presence) and any additional scopes your workflow needs.
• Set up the OAuth authorization flow: Redirect users to your app's authorization page. When a user logs in and grants access, Slack will return a user-specific OAuth token tied to that individual account.
• For enterprise-scale scenarios, you can use Slack's Enterprise Grid OAuth flow to streamline authorization across multiple users in your organization, though this requires admin-level setup and coordination.
• Store these tokens securely (encrypted at rest, with limited access permissions) since they grant direct access to the user's Slack account.

2. Legacy User Tokens (Not Recommended) #

Slack still supports legacy user tokens, but they're deprecated and not advised for production use due to inherent security risks:

• A user can generate their own legacy token from Slack's API settings page, but this token is exclusively tied to their account. You cannot generate tokens for other users this way—they'd have to create and share their own token with you, which is a poor security practice and violates Slack's policies if done without explicit, legitimate consent.

Critical Notes to Remember #

• Bot tokens won't work here: The users.setPresence endpoint requires a user-level token; bot tokens can only modify the bot's own presence, not other users'.
• Never obtain tokens without consent: Accessing or using another user's token without their explicit permission violates Slack's Terms of Service and could result in your app being banned, or even legal consequences.
• Token management: For handling multiple users, build a flow where each user authorizes your app to obtain their token, then manage those tokens securely in your system.

内容的提问来源于stack exchange，提问作者Thomas