Node.js开发Slack Bot：AccessToken获取与跨端验证流程咨询

Hey there! No worries about your English at all—let’s break this down step by step for your Slack Bot and API setup. I’ll walk you through the entire OAuth flow and how to connect your Bot, Slack, and your own API server.

First, let’s get the big picture straight:

1. A user authorizes your Slack Bot through Slack’s OAuth page
2. Slack sends a temporary authorization code to your Bot (or directly to your API, depending on your setup)
3. Your Bot sends this code to your API server
4. Your API exchanges this code for a valid Slack Access Token
5. Your API verifies the Slack Access Token is legitimate
6. Your API generates its own business token (for your Bot to use when requesting data) and sends it back to the Bot
7. Your Bot uses this business token to fetch data from your API

First, you need to configure a Slack App in the Slack Developer Portal:

• Create a new Bot app, then go to OAuth & Permissions
• Add your Redirect URL (this is the endpoint on your API server that will receive Slack’s authorization code, e.g., https://your-api-domain.com/slack/oauth-callback)
• Select the scopes your Bot needs (like chat:write, channels:read—pick what matches your Bot’s functionality)
• Save your Client ID and Client Secret (you’ll need these later—keep them secret, don’t hardcode them!)

Your Bot needs to send users to Slack’s authorization page. The URL looks like this:

https://slack.com/oauth/v2/authorize?client_id=YOUR_SLACK_CLIENT_ID&scope=YOUR_SELECTED_SCOPES&redirect_uri=YOUR_REDIRECT_URL

When the user clicks "Allow", Slack will redirect them to your specified Redirect URL, and append a code parameter (this is the temporary authorization code).

In your Node.js Bot (assuming you’re using Express or similar), capture the code from Slack’s redirect, then send it to your API. Example:

// If using Express, you might have a route that handles Slack's redirect
app.get('/slack/redirect', async (req, res) => {
  const authCode = req.query.code;

  // Send the code to your API server
  try {
    const apiResponse = await fetch('https://your-api-domain.com/slack/exchange-code', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ code: authCode })
    });

    const { businessToken } = await apiResponse.json();
    // Store this businessToken in your Bot's database for future use
    res.send('Authorization complete!');
  } catch (err) {
    res.status(500).send('Authorization failed');
  }
});

Now your API server takes the code and exchanges it with Slack for a valid Access Token. Use Slack’s oauth.v2.access endpoint:

// In your API server (Express example)
const axios = require('axios');
require('dotenv').config(); // Use dotenv to store secrets

app.post('/slack/exchange-code', async (req, res) => {
  const { code } = req.body;

  try {
    // Call Slack's API to get the Access Token
    const slackResponse = await axios.post('https://slack.com/api/oauth.v2.access', null, {
      params: {
        client_id: process.env.SLACK_CLIENT_ID,
        client_secret: process.env.SLACK_CLIENT_SECRET,
        code: code,
        redirect_uri: process.env.SLACK_REDIRECT_URL
      }
    });

    // Check if Slack returned an error
    if (!slackResponse.data.ok) {
      return res.status(400).json({ error: slackResponse.data.error });
    }

    const slackAccessToken = slackResponse.data.access_token;
    // Next step: verify this token is valid
  } catch (err) {
    res.status(500).json({ error: 'Failed to exchange code with Slack' });
  }
});

To make sure the Access Token is legitimate (not a fake one), call Slack’s auth.test endpoint with the token:

// Continuing from the previous code block
const authTest = await axios.post('https://slack.com/api/auth.test', null, {
  headers: { Authorization: `Bearer ${slackAccessToken}` }
});

if (!authTest.data.ok) {
  return res.status(401).json({ error: 'Invalid Slack Access Token' });
}

// If we're here, the token is valid—we can trust it
const slackUserId = authTest.data.user_id;
const slackTeamId = authTest.data.team_id;

Now that you’ve verified the Slack token, create your own business token (we’ll use JWT here, but you can use any method you prefer). This token is what your Bot will use to request data from your API:

const jwt = require('jsonwebtoken');

// Create a JWT that includes the user's Slack info (expires in 7 days)
const businessToken = jwt.sign(
  { userId: slackUserId, teamId: slackTeamId },
  process.env.JWT_SECRET,
  { expiresIn: '7d' }
);

// Send the token back to the Bot
res.json({ businessToken });

Once the Bot has the business token, it can send requests to your API with this token in the authorization header:

// In your Bot, when you need to fetch data
const businessToken = '...'; // Retrieve from your Bot's database

const dataResponse = await fetch('https://your-api-domain.com/api/data', {
  headers: {
    'Authorization': `Bearer ${businessToken}`,
    'Content-Type': 'application/json'
  }
});

const data = await dataResponse.json();
// Use this data in your Bot's logic (e.g., send messages to Slack)

• Keep secrets safe: Store Slack’s Client Secret, your JWT secret, etc., in environment variables (never commit them to code!)
• Match redirect URLs exactly: The redirect URL in your Slack app must be identical to the one you use in your code (including HTTPS/HTTP)
• Handle errors: Always check Slack’s API responses for ok: false and handle errors like expired codes or invalid credentials
• Token expiration: Set reasonable expiration times for your business tokens, and add logic for refreshing them if needed

内容的提问来源于stack exchange，提问作者Erfan