Understand app permissions

Apps are third-party services that have been granted permission to connect with your Slack workspace. Each app has a unique set of permissions that tell you what information the app can access in Slack and how it can use that information. Use this guide to understand app permissions and how to evaluate them.

 

App permissions overview 

An app’s permission scopes depend on the kinds of things it’s supposed to do. Generally, apps can do three things in Slack: 

  • View information
  • Post information 
  • Perform actions 

For example, let's say you've installed two different apps to your workspace. The first is a calendar app — like Google Calendar — that helps your team manage their calendars and respond to meeting invites in Slack. The app may have access to your channels, member profiles, and messages to make sure meeting updates and event notifications end up in the right place.

The second is the Twitter app which helps you stay on top of your company's social activity by pulling notifications from Twitter into Slack. This app only has the ability to post messages to channels you've specified. 

Tip: Before installing an app, we recommend reviewing its privacy policy. Only choose tools and services you trust.

 

Evaluate app permissions 

There are two things you should consider when evaluating an app's permissions: 

  1. What information it will have access to in Slack, such as member profiles, channel names, messages, or files.  
  2. What an app can do with the information it can access, like post messages, modify content, or create channels.

Installed apps

If an app is already installed to your workspace, search for it in the App Directory to see details about who installed it and what information the app can access.

New apps

When you install an app or approve an app installation, you'll see a full list of permissions the app is requesting, and grant the app permission to view information and take actions in your workspace.

Screenshot of Google Calendar app permissions

Apps can take actions on behalf of a user or on behalf of the app. For example, an app may request permission to access messages in channels a user belongs to or post messages on their behalf. Apps can also take actions independently of users, like adding slash commands or posting messages as the app. 

Bots

Some apps create bot users in Slack. Bots can have access to the same information workspace members do, and may be able to take the same actions members can. If an app you're installing requests the bot scope, that means it's an older app and its bot may have access to a wide range of actions and information in Slack. 

Newer apps will request a narrower set of scopes that allow bots access to specific actions and information, which you can review during installation — regardless of whether an app has updated its bot user or not.

Screenshot of Google Calendar app permissions 


View access types 

Access types help you understand the kind of information an app can view in Slack. Workspace Owners and Admins can use a filter in the Slack App Directory to see this information: 

  1. Visit the Slack App Directory
  2. Click Manage in the top-right corner of the screen.
  3. Select Apps from the left sidebar. 
  4. Open the Access type drop-down menu to browse installed apps.
    Screenshot of apps and access type sorting options in the Slack App Directory