OpenClaw Slack setup

A Slack app is a manifest, two or three tokens and one decision about how events reach the gateway, and the OpenClaw docs hand you the manifests to paste rather than a scope list to assemble. Here is the install, the two manifests, the Socket Mode and HTTP paths with the tokens each one needs, the user-identity option that posts as a real person, and the token model the status command reports on.

Install and manifests

• The plugin is installed with the plugins install command for the Slack package, which registers and enables it and then does nothing until the Slack app and channel settings exist; the manifests on the setup page create a workspace-scoped installation, and an Enterprise Grid organisation uses the dedicated org-wide manifest and workflow instead.
• You create the app from a manifest on the Slack apps page, pick your workspace and paste one of two manifests: Recommended matches the plugin's full feature set, App Home, slash commands, files, reactions, pins, group DMs and emoji and user-group reads, while Minimal is for workspaces whose policy restricts scopes and covers DMs, channel and group history, mentions and slash commands but drops files, reactions, pins, group DMs, emoji reads and user-group reads.
• Both manifests declare a bot user that is always online, an App Home with a writable messages tab, an Agent View description with three suggested prompts, one slash command named after OpenClaw, and the bot events the plugin listens to; the HTTP variants add the request URL to the slash command, the event subscriptions and the interactivity block.
• After Slack creates the app, Socket Mode needs an app-level token with the connections write scope from Basic Information and the Bot User OAuth token from the install page, while the HTTP path needs the Signing Secret from App Credentials and the same bot token.

The companion app is invisible plumbing: other Slack members see messages from the authorizing human, not from an OpenClaw bot.

Socket Mode, HTTP, and posting as a person

The recommended configuration keeps tokens out of the config file: export the app token and the bot token in the environment, write a small patch that enables the channel, sets the mode to socket and points each token at an environment SecretRef, run the config patch command with a dry run first and then for real, and start the gateway. Once the Slack block exists, the app and bot token variables also serve as credential fallback for the default account when they are exported in the gateway's environment. The HTTP path sets the mode to http, references the bot token and the signing secret and sets the webhook path, which defaults to the events path; the three URL fields in the manifest, the slash command URL, the event request URL and the interactivity URLs, all point at the same endpoint because Slack's schema names them separately while OpenClaw routes by payload type, and a slash command without its URL silently does nothing in HTTP mode. Multi-account HTTP setups give each account a distinct webhook path so registrations do not collide. User identity lets OpenClaw read and post as the human who authorises the app: the user token is the acting identity and a companion app carries the Events API traffic over Socket Mode or a request URL without needing a bot user. That companion app takes user token scopes for history, conversation lookup, people, posting and opening DMs, subscribes to the four message events on behalf of users rather than only in the bot list, chooses one transport, and is installed and authorised as the intended human, whose user OAuth token goes into the user-token key with post-as set to user. DMs and group DMs work only through that user-scope subscription, because a bot cannot join a human one-to-one DM or be inserted into an existing group DM, and OpenClaw drops user-scope message events authored by the resolved human so its own messages never trigger self-replies.

The token model

• Bot identity, the default, needs the bot token plus the app token for Socket Mode or the bot token plus the signing secret for HTTP; user identity needs the user token plus the app token or the signing secret and no bot token; relay mode needs the bot token plus a relay URL, auth token and gateway ID and neither an app token nor a signing secret.
• Every token key accepts a plaintext string or a SecretRef object, config tokens override the environment fallback, the three environment variables apply only to the default account, and the user token defaults to read-only behaviour, so for bot identity actions and directory reads can prefer an optional user token while writes keep the bot token unless read-only is switched off; with post-as set to user, reads and writes always use the user token.
• Account inspection tracks a source and a status per credential, available, configured-unavailable or missing, where configured-unavailable means the account is configured through a SecretRef or another non-inline source that the current command or runtime path could not resolve; HTTP mode reports the signing-secret status, and Socket Mode reports the bot and app token statuses for bot identity or the user and app token statuses for user identity.

OpenClaw on Slack is the channel post this setup belongs to, and OpenClaw Slack access control what to decide next about who may reach the app.

Why two transports

Socket Mode needs no public URL, which is why it is the default for a gateway on a laptop or behind a firewall; the HTTP path suits a gateway that already has a public origin and lets Slack verify each request with the signing secret. OpenClaw plugins explains how a channel arrives as a plugin, and OpenClaw remote access how a gateway becomes reachable when you do want the HTTP path.

On Diali

Slack is one of the channels Diali connects from the dashboard, and the runtime config is generated from it and replaced at each release, so the token model above is the vocabulary behind that screen rather than a patch you write. Slack on Diali describes the channel on Diali and Diali security the boundary every connected channel shares.

• Paste a manifest: Recommended for everything, Minimal for strict workspaces.
• Socket Mode wants an app token; HTTP wants a signing secret.
• Posting as a person needs a user-scope companion app.