Slack

1. Go to Slack API Page.
   You can create a new Slack app here.
2. Click “Create New App” in the top right corner. A pop-up modal “Create an app” will show up.
3. Choose “From a manifest” and enter the required information:
   • Pick a workspace to develop your app in: Select a workspace where you want to install the app. (e.g. airmdr)
4. Click Next.
5. Paste the JSON content [MANIFEST COPY] generated earlier from the AirMDR Integration Dashboard.
   Sample Manifest

   {
       "display_information": {
           "name": "AirMDR",
           "description": "Sends real-time messages to users for confirming security-related actions",
           "background_color": "#002b87"
       },
       "features": {
           "app_home": {
               "home_tab_enabled": false,
               "messages_tab_enabled": true,
               "messages_tab_read_only_enabled": false
           },
           "bot_user": {
               "display_name": "AirMDR",
               "always_online": true
           }
       },
       "oauth_config": {
           "scopes": {
               "bot": [
                   "incoming-webhook",
                   "users:read",
                   "users:read.email",
                   "chat:write",
                   "im:write",
                   "app_mentions:read",
                   "im:history"
               ]
           }
       },
       "settings": {
           "event_subscriptions": {
               "request_url": "https://app.airmdr.com/airmdrapi/webhooks/slack/v1/events?token=XXX",
               "bot_events": [
                   "message.im"
               ]
           },
           "interactivity": {
               "is_enabled": true,
               "request_url": "https://app.airmdr.com/airmdrapi/webhooks/slack/v1/interactions?token=XXX"
           },
           "org_deploy_enabled": false,
           "socket_mode_enabled": false,
           "token_rotation_enabled": false
       }
   }
   
   Optionally you can customise the JSON content information to easily identify the application. “display_information” → “name”: < your org name> “bot_user” → “display_name”: < your org name>
6. Click Next.
7. In the Review summary & create your app pop-up modal cross-verify the content and click Create.

1. In the left navigation menu, navigate to Features → Incoming Webhooks.
2. Make sure the toggle option “Activate Incoming Webhooks” is On.
3. Scroll down to the “Webhook URLs for Your Workspace” section.
4. Click “Add New Webhook to Workspace”.
5. Select a channel in the drop-down list where you want the bot to post to.
6. Click “Allow” to grant permissions.
7. Once redirected, your Webhook URL will appear under Webhook URLs for Your Workspace.
8. Click Copy to save it for use.

Slack requires validation of your request URL to enable event subscriptions. To ensure your endpoint (e.g., https://yourdomain.com/slack/events) is publicly accessible and configured to handle Slack’s verification request (responds with the challenge value).

1. In the left navigation menu, navigate to Settings → Event Subscriptions.
2. Toggle Enable Events to On.
3. Click Retry button in the Request URL.
4. After successful verification, click Save Changes at the bottom.

1. In the left navigation menu, navigate to Features → OAuth & Permissions.
2. In the OAuth Tokens section, click “Install to <your workspace>”.

1. In the “Where should <your workspace> post?”
2. Select a #channel in the drop-downlist where to post as an app.
3. Click Allow.
4. After authorization, your Bot User OAuth Token (xoxb-...) will appear under OAuth Tokens for Your Workspace.
5. Click Copy to store the token.
   Click on Revoke Tokens button at the bottom of the page to Revoke All OAuth Tokens:
   You can revoke all OAuth tokens if you want to invalidate the access any existing tokens have to Slack workspace data.
   Users will need to grant your app permissions again to use it.

1. In the left navigation menu, navigate to Settings → Basic Information.
2. Under App Credentials, locate the Signing Secret.
3. Click Show and then Copy. Store it in a secure location (e.g., secrets manager).

​

✅ Summary of Retrieved Credentials