Cert++
  1. Home
  3. Slack Developer

Slack Developer

Checklist progressProgress

0/255Learned

Slack Developer Study Checklist
  • Platform Administrator
  • Platform App Builder
  • Platform Foundations
  • Platform Developer
  • Platform Administrator II
  • Agentforce Sales Consultant
  • Agentforce Service Consultant
  • Platform Data Architect
  • Platform Development Lifecycle and Deployment Architect
  • Platform Identity and Access Management Architect
  • Platform Integration Architect
  • Platform Sharing and Visibility Architect
  • Heroku Architect
  • B2C Solution Architect
  • Experience Cloud Consultant
  • Agentforce Field Service and Operations Consultant
  • Agentforce Nonprofit Consultant
  • Data 360 Consultant
  • Omnistudio Consultant
  • CRM Analytics and Einstein Discovery Consultant
  • Platform User Experience Designer
  • Platform Strategy Designer
  • B2C Commerce Developer
  • JavaScript Developer
  • Omnistudio Developer
  • Platform Developer II
  • Marketing Cloud Engagement Administrator
  • Marketing Cloud Engagement Specialist
  • Marketing Cloud Engagement Consultant
  • Marketing Cloud Account Engagement Specialist
  • Marketing Cloud Next Consultant
  • Agentforce Sales Foundations
  • Business Analyst
  • Marketing Cloud Engagement Developer
  • Marketing Cloud Engagement Foundations
  • Agentforce Specialist
  • Agentforce Life Sciences Consultant
  • B2B Commerce Administrator AP
  • B2B Commerce Developer AP
  • Agentforce Communications AP
  • Agentforce Consumer Goods AP
  • Agentforce Financial Services AP
  • Agentforce Health AP
  • Agentforce Manufacturing AP
  • Public Sector Solutions AP
  • Revenue Cloud Consultant
  • MuleSoft Integration Foundations
  • MuleSoft Developer
  • MuleSoft Developer II
  • MuleSoft Platform Integration Architect
  • MuleSoft Platform Architect
  • Tableau Desktop Foundations
  • Tableau Data Analyst
  • Tableau Consultant
  • Tableau Server Administrator
  • Tableau Next Consultant
  • Tableau Architect
  • Slack Administrator
  • Slack Consultant
  • Slack Developer

Checklist progressProgress

0/255Learned

  • Identifying workspace processes worth automating
  • Actions a Slack app can take in a workspace
  • Workflow Builder versus a custom Slack app for automating a process
  • Workflow trigger types and when each fits
  • Built-in Slack functions versus third-party connector steps
  • Custom workflow steps built as app functions
  • Bringing external system events into Slack
  • App Home tabs and their customization options
  • Home tab content design and per-user tailoring
  • Publishing and refreshing Home tab views
  • Modal design for focused input
  • Interactive messages for in-conversation actions
  • Ephemeral messages versus direct messages
  • Choosing App Home, modals or messages for a use case
  • Combining Home tab, modals and messages in one workflow
  • When to add backup collaborators to a Slack app
  • App collaborator capabilities and guest collaborator limits
  • Managing collaborators from app settings and the Slack CLI
  • Restoring access to internal apps without active collaborators
  • Core components of a Slack workflow
  • Identifying business processes suited to Slack apps and workflows
  • Choosing Slack steps, connector steps or custom steps in a workflow
  • Defining a custom workflow step in an app manifest
  • Completing a custom workflow step's execution
  • Interactive approval request flow in messages
  • Custom workflow step hosting options and limitations
  • Distributing apps that contain custom workflow steps
  • Automatic versus user invocations of a Slack app
  • Scheduled, external-service and event-driven app invocations
  • Request URL configuration for interactivity
  • Interaction payload types and the type field
  • Acknowledgment response timing for interaction payloads
  • Choosing how to respond to an interaction payload
  • response_url message responses versus Web API posting
  • Chaining interactions into multi-step app workflows
  • Designing for workspace size, locales, devices and settings
  • Designing for user types, roles and app access
  • Global shortcuts versus message shortcuts
  • Creating and configuring app shortcuts
  • Responding to global and message shortcut invocations
  • Slash commands as a workflow entry point
  • Choosing a user entry point for an app workflow
  • Choosing the right surface for an app need
  • App Home tabs and publishing the Home tab
  • Opening modals in response to user interactions
  • Modal view objects and the modal view stack
  • Blocks, block elements and composition objects
  • Choosing layout blocks for a structured message or view
  • Choosing interactive elements for a user input need
  • Select menu option sources and the Options Load URL
  • Identifying blocks and elements with block_id and action_id
  • Input blocks versus actions blocks for collecting modal data
  • Responding to modal submissions with response_action
  • Passing state between interactions with private_metadata
  • Top-level text fallback and accessibility in block messages
  • Block limits and block availability per app surface
  • Web API versus Events API for an app requirement
  • Incoming webhooks versus chat.postMessage for posting messages
  • Direct API calls versus a Bolt or SDK-based app
  • Specialized Slack APIs for administration, compliance and service health
  • Web API request formatting and token placement
  • Interpreting Web API responses and method error codes
  • Choosing a Web API method for a common app task
  • Bolt listener client versus top-level app.client for Web API calls
  • Cursor-based pagination for Web API collection methods
  • Event Subscriptions setup and request URL verification
  • Choosing event types for an app's use case
  • Bot events versus workspace events subscriptions
  • Event subscription scopes and reinstallation
  • Events API event wrapper and payload fields
  • Handling Events API events with Bolt listeners
  • Acknowledging event deliveries and Slack retry behavior
  • App uninstall and token revocation events
  • HTTP versus WebSocket connection characteristics for Slack apps
  • Choosing Socket Mode or HTTP request URLs for an app's environment
  • Enabling Socket Mode and its effect on app configuration
  • App-level tokens and apps.connections.open in Socket Mode
  • Running a Bolt app in Socket Mode versus HTTP mode
  • Event delivery mode for Slack Marketplace and distributed apps
  • Legacy, deprecated and retired status of platform features
  • Legacy custom integrations and their Slack app equivalents
  • Classic apps versus granular-permission Slack apps
  • OAuth v1 versus OAuth v2 installation endpoints
  • Deprecated perspectival scopes and their granular replacements
  • Legacy RTM API versus Events API and Socket Mode
  • Deprecated verification token versus signing secret
  • Legacy message attachments versus Block Kit blocks
  • Legacy dialogs versus modals for collecting user input
  • Web API rate limit tiers and how they are scoped
  • Burst limits versus rate limits
  • Responding to HTTP 429 and the Retry-After header
  • Built-in rate limit handling in Bolt and the Slack SDKs
  • Message posting and incoming webhook rate limits
  • Events API delivery limits and the app_rate_limited event
  • Workflow trigger rate limits
  • SCIM API rate limits
  • Building with empathy for the end user
  • Onboarding and in-app help for users new to the app
  • Bot user naming and renaming
  • Message attachment bar and app profile colors
  • Slash command naming and collisions
  • Composing clear, scannable Block Kit messages
  • Ephemeral versus in-channel app responses
  • App notification volume and etiquette
  • Timezone-aware timing of app notifications
  • Localizing app language for users and channels
  • Updating messages after a user interacts
  • Communicating errors and input validation to users
  • Accessible app content for all users
  • Slack desktop versus mobile client considerations
  • User preferences that change how app content appears
  • Workspace-level settings that constrain app messages
  • Accounting for guests, admins and bot users in app design
  • Designing for small and very large workspaces
  • Developer Policy user experience obligations

Implement the OAuth installation flow

0/10

  • Single-workspace token setup versus OAuth for multi-workspace apps
  • Steps of the v2 OAuth installation flow
  • Declaring bot and user scopes for installation
  • Redirect URL configuration and matching rules
  • State parameter and state stores for CSRF protection
  • Code exchange with oauth.v2.access
  • Tokens and installation details in the oauth.v2.access response
  • Bolt built-in OAuth setup and install routes
  • Incoming webhooks provisioned through OAuth installation
  • Requesting additional user authorizations after installation

Request the appropriate scopes for your app's use case

0/8

  • Deriving a least-privilege scope list from an app's methods and events
  • Conversation-type scope families for public, private, DM and group DM access
  • Choosing among message-posting scopes
  • Scopes behind slash commands, shortcuts and link unfurling
  • Matching requested scopes to supported token types
  • Sign in with Slack scopes versus Add to Slack installation
  • Admin API scopes and their installation requirements
  • Adding or removing scopes on an installed app

Request the appropriate tokens for your app's use case

0/7

  • Bot tokens versus user tokens for an app's actions
  • App-level tokens and the jobs they serve
  • Configuration tokens for the App Manifest APIs
  • Service tokens for Slack CLI automation
  • Workflow tokens and borrowed channel visibility
  • Identifying Slack token types by prefix
  • Legacy bot and workspace tokens versus granular v2 bot tokens

Identify the steps you could take to make your app communicate securely in Slack

0/8

  • Signing secret signature verification for incoming Slack requests
  • Request timestamp checks against replay attacks
  • Built-in request verification in Bolt frameworks
  • TLS requirements for connections to Slack
  • Transmitting tokens over HTTP: POST requests and TLS
  • Verifying the connecting account after an enterprise OAuth install
  • Outbound domain restrictions for Slack-hosted functions
  • Access control and input validation for workflow functions and triggers

Store and retrieve data and tokens safely

0/11

Keeping app credentials out of code: development versus production

Learn this concept
Unseen

Installation stores for multi-workspace token persistence

Learn this concept
Unseen

Retrieving the right token for each workspace, org or user

Learn this concept
Unseen

Encrypting stored tokens and securing backups and hosts

Learn this concept
Unseen

Keeping tokens out of logs, error messages and the UI

Learn this concept
Unseen

Regenerating the client secret and signing secret

Learn this concept
Unseen

Token rotation: expiring access tokens and refresh calls

Learn this concept
Unseen

Automatic token rotation in Bolt and InstallProvider

Learn this concept
Unseen

Deleting and revoking stored tokens when access ends

Learn this concept
Unseen

Secrets and sensitive data in Slack-hosted workflow apps

Learn this concept
Unseen

Safe storage and querying with Slack datastores

Learn this concept
Unseen
  • Enterprise org architecture of organizations and workspaces
  • Global user IDs versus local user IDs
  • User ID translation and migration to global user IDs
  • Detecting and storing Enterprise org context with enterprise_id
  • Opting an app into organization-wide deployment
  • Enterprise Grid admin roles and app approval for org installs
  • Org-wide installation flow and adding the app to workspaces
  • Scope inheritance from an org-wide installation
  • Token storage design for organization-ready apps
  • Handling users from other workspaces in an Enterprise org
  • Multi-workspace channels versus Slack Connect channels
  • Channel IDs versus channel names with chat.postMessage in org-ready apps
  • Slash command behavior in Enterprise org workspaces
  • Legacy RTM API and legacy bots in Enterprise orgs
  • Slack CLI development on an Enterprise Grid organization
  • Developer sandbox as an Enterprise org test environment
  • Regular workspace versus developer sandbox versus partner sandbox
  • Developer sandbox capacity limits
  • Developer sandbox feature restrictions
  • Sandbox lifespan, extension and archival lifecycle
  • Enterprise admin governance and policy inheritance for sandboxes
  • Deciding when an app must support Slack Connect channels
  • Conversations API and channel IDs for Slack Connect channels
  • Determining privacy and type of an externally shared channel
  • Detecting when a channel becomes shared or unshared
  • Channel ID changes when channels are shared or unshared
  • External members and strangers in shared channels
  • Referencing and messaging external users in shared channels
  • Slack Connect app design considerations for external users
  • Slack Connect API scopes for invitations and channel management
  • Slack Connect invitation lifecycle with API methods and events
  • App blueprints and code samples as starting points for common app patterns
  • First-party Slack tools versus community-developed libraries
  • Slack developer support channels, issue trackers and changelog
  • Built-in capabilities of the Bolt framework
  • Bolt framework versus the Slack SDKs for custom app foundations
  • Bolt versus Deno Slack SDK and Workflow Builder by hosting model
  • Purpose and value of Block Kit Builder in Slack app UI design
  • Slack Developer Tools (SDT) app purpose and capabilities
  • App manifests for setting up and managing app configuration
  • Slack CLI commands across the app development lifecycle
  • Admin API purpose and trade-offs against the admin dashboard
  • Admin API plan availability and admin scope requirements
  • Programmatic workspace creation and user assignment at scale
  • Automated approval of workspace invite requests
  • Admin, owner and system role assignment through admin methods
  • Automated app approval and restriction workflows across an org
  • Session reset for lost or stolen devices
  • Channel management and bulk channel lifecycle across workspaces
  • Custom retention periods for specific conversations via admin methods
  • IdP group default channels versus private channel allowlists
  • Admin API versus SCIM, Audit Logs and Discovery APIs for an admin need
  • When to use the SCIM API versus other Slack admin APIs
  • SCIM API authorization: admin scope and Bearer token
  • SCIM Users and Groups endpoints and HTTP methods
  • SCIM user attributes and Slack profile field mapping
  • Deprovisioning and deactivating users with SCIM
  • Provisioning guest accounts through SCIM
  • Managing user groups and IdP groups with SCIM
  • SCIM 1.1 versus SCIM 2.0 in Slack
  • Audit Logs API use cases and limitations
  • auditlogs:read scope and user token requirements
  • Audit Logs API endpoints and what each returns
  • Anatomy of an audit event record
  • Filtering and paginating results from the logs endpoint
  • Audit Logs API rate limits versus Web API rate limits
  • Discovery API purpose and permitted use cases
  • eDiscovery versus DLP apps built on the Discovery API
  • Discovery API data coverage, export format and retention interplay
  • Discovery API versus Audit Logs API for compliance needs
  • Discovery API versus conversations.history for org-wide message capture
  • Enterprise org roles that can install apps requesting admin scopes
  • Org-level installation of apps that need admin tokens
  • SCIM API token generation roles on Business+ versus Enterprise
  • SCIM token permission ceiling and token-holder role retention
  • Owner requirement for Audit Logs API tokens
  • Roles that can enable the Discovery API and install its apps
  • When to keep an app undistributed in a single workspace
  • Install App page tokens versus an OAuth 2.0 install flow
  • Preparing an app for distribution to other workspaces
  • Activating public distribution and the install tools it unlocks
  • Deactivating public distribution versus discontinuing a Marketplace listing
  • Uninstall handling for apps installed on multiple workspaces
  • Private distribution of org-ready apps across an Enterprise org
  • Tokens and scopes when an app moves to organization-wide deployment
  • Single-workspace, unlisted distributed and Marketplace-listed apps compared
  • Unlisted distribution versus a Marketplace listing for a rollout stage
  • Retired workspace apps versus current single-workspace Slack apps
  • Slack Marketplace submission prerequisites
  • App types unsuitable for Slack Marketplace listing
  • Slack Marketplace listing content guidelines
  • App Developer Policy data and privacy obligations
  • Security and privacy design expected of Marketplace apps
  • Slack Marketplace review lifecycle and launch planning
  • Direct Install URL versus landing page installation
  • App Suggestions for published Marketplace apps

Prepare for the Exam

Play Today's Certle

Study Community

Ask questions and get the latest info from other Slack Developer studiers. 670 members and growing.

Go to Discord
  1. Slack Developer Checklist
  3. Design for Security

Keeping app credentials out of code: development versus production

Explainer

Learn More

Practice Question

Studying for this exam?

This is one of 255 concepts on the Salesforce Slack Developer exam.

Looking for practice exams? Click below to try one!

Keep going

Next conceptInstallation stores for multi-workspace token persistence

Checklist progress

0/255 (0%)

0 of 255 concepts learned

Tip: You can filter concepts by status.

Prepare for the Exam

Play Today's Certle

Study Community

Ask questions and get the latest info from other Slack Developer studiers. 670 members and growing.

Go to Discord
Close
  1. Slack Developer Checklist
  3. Design for Security
Keeping app credentials out of code: development versus production

Explainer

Learn More

Practice Question

Studying for this exam?

This is one of 255 concepts on the Salesforce Slack Developer exam.

Looking for practice exams? Click below to try one!

Keep going

Next conceptInstallation stores for multi-workspace token persistence

Explainer

A Slack app depends on secrets such as its client secret, bot tokens, and user tokens, and anyone who holds them can act with the app's access. The rule is the same at every stage: never hardcode secrets in source code or store them in places like public repositories. What changes between development and production is where the secret lives. During development it lives in a local .env file, and in production it lives in a dedicated secrets manager or in Slack's own environment variable store.
Core information
  • An app's tokens, keys, and credentials are highly sensitive. Never hardcode them directly into the app's source code, and never store them in non-secure locations such as public repositories.
More details and nuances
  • Running slack env add with the secret typed on the command line can leave the secret in your shell's history. To avoid this, pass it through shell environment variables, or run slack env add with no parameters. With no parameters, the command prompts for the name and value using a password display.

Explainer

A Slack app depends on secrets such as its client secret, bot tokens, and user tokens, and anyone who holds them can act with the app's access. The rule is the same at every stage: never hardcode secrets in source code or store them in places like public repositories. What changes between development and production is where the secret lives. During development it lives in a local .env file, and in production it lives in a dedicated secrets manager or in Slack's own environment variable store.
Core information
  • An app's tokens, keys, and credentials are highly sensitive. Never hardcode them directly into the app's source code, and never store them in non-secure locations such as public repositories.
More details and nuances
  • Running slack env add with the secret typed on the command line can leave the secret in your shell's history. To avoid this, pass it through shell environment variables, or run slack env add with no parameters. With no parameters, the command prompts for the name and value using a password display.