Previously available in early access by request only, PKCE can now be enabled directly in your app settings without contacting Slack support.

Key things to know​

• Enabling PKCE marks your app as a public client. This is a one-way operation; it cannot be undone without contacting Slack support.
• OAuth installations which redirect to a custom URI scheme (e.g. myApp://auth) will always receive rotating tokens, even if token rotation is turned off. OAuth installations issued to a standard web URL (e.g. myWebshite.com/auth) will only receive rotating tokens if the 'token rotation' setting is enabled. All refresh tokens issued to PKCE-enabled apps expire after 30 days.
• Once enabled, PKCE arguments (code_challenge, code_challenge_method, code_verifier) are optional for standard OAuth flows, but required when redirecting to a custom URI scheme.
• Desktop redirects (custom URI schemes and localhost redirects for PKCE-enabled apps) cannot request bot scopes.

Getting started​

Check out the PKCE documentation to learn how to implement the full PKCE flow, including how to generate a code_verifier, construct the authorization URL, and exchange the code using the oauth.v2.access API method without a client secret.

• The slack create command now normalizes project directory names to kebab-case (lowercase, dash-delimited, no whitespace or special characters). For example: slack create "My App" now creates a my-app directory instead of a My-App directory.
• We've updated the the slack create command's app name prompt to show the randomly generated app name as placeholder text. You can press Enter to accept the default name, or type in a new name.
• Bolt JavaScript and Bolt Python projects now default to using the local manifest.json as the app manifest (previously, it was a remote manifest from app settings). Changes to the app manifest via app settings will now be detected by the Slack CLI, and a prompt will be displayed before any manifest update action occurs (e.g., when using the slack run command). The manifest source is set after creating a new project with the slack create command or by initializing an existing project using the slack init command, and the setting is stored as "manifest.source": "local" in the .slack/config.json file.
• We've updated the slack app link command to support projects that use a manifest file as the manifest source (manifest.json). As part of this:
  • A warning message will not be displayed when the manifest source is local (project file).
  • The manifest source is not changed; it now uses the project's current manifest source.
  • The current manifest source is displayed for your reference.
  • A tip on where to change the manifest source (.slack/config.json) is displayed.
• We've also updated the app manifest overwrite warning prompt wording and appearance:
  • It now clarifies that the app settings manifest will be overwritten by the project's app manifest file.
  • It now displays a warning that changes were detected on the app settings manifest that are not in the project's app manifest file.
• We fixed a bug: we now output a warning instead of an error if activating the Python virtual environment (.venv/) fails.

What's changed:

• App configuration: Mark scopes as optional directly from the app settings page or via your app manifest using the new bot_optional and user_optional fields.
• OAuth flow: Users now see optional scopes presented separately during installation and can choose which ones to grant.
• Admin controls: Workspace admins can pre-approve which optional scopes are available to their users when approving apps.
• App manifest: Two new fields—bot_optional and user_optional—are now supported under oauth_config.scopes. See App manifest fields for details.

If your app uses scopes that aren't strictly required for core functionality, consider marking them as optional to improve installation rates. Read more on the Installing with OAuth page.

• syntax-highlighted code blocks (language-specific)
• tables
• task lists
• dividers
• variable-sized headers

Check out our rich text block and markdown block reference for more details!

• The slack create command now prompts you for a custom app name if the randomly generated default isn't your thing. This prompt appears before scaffolding a new project from a template, and when making new project directories with your custom app name, we now replace spaces with a dash (instead of removing spaces altogether) to make navigation a bit better.
• The slack create command now updates the app name in the package.json and pyproject.toml project files.
• We've updated the slack create and slack init commands to support creating a Python virtual environment (.venv) when it doesn't exist, and installing the project's dependencies from the requirements.txt and pyproject.toml project files.
• When running Slack CLI commands in a Bolt Python project, the Slack CLI will attempt to automatically activate the Python virtual environment (.venv). This allows commands that use the slack-cli-hooks Python package to run safely and successfully, even when the terminal system doesn't have the virtual environment activated.
• We've added a --subdir flag to the slack create command for extracting a subdirectory from a template repository as the project root. This supports monorepo-style templates where multiple apps live in subdirectories (e.g., slack create my-app -t org/monorepo --subdir apps/my-app).
• The slack docs command opens the slack developer docs site, and you can now use the --search flag to open the docs search page with the provided query.
• We fixed a bug and now avoid infinite loops when searching for the root project .slack directory for projects existing on drives other than the C: drive on Windows.
• We fixed a bug and now check whether an installed git command exists on Windows.

• When running the slack create command with the agent argument, a list of agentic apps are now highlighted for selection. If you want to name your app "agent" and not create an agentic app, you can use the --name flag instead to explicitly set your app name. Refer to the slack create command for more details.
• When running the slack create command, the available templates are now shown without requiring an immediate selection when using the --list flag. Refer to the slack create command for more details.
• The slack deploy command now references the latest online documentation, with a suggestion to run a development app using the slack run command if a deploy hook script doesn't exist. Refer to our hooks documentation for more details.
• We now prompt you to log in if no prior authentications are detected when running any command that requires credentials, rather than exiting with an error.

Slack MCP Server​

The MCP server enables AI agents to interact with Slack content through tools designed for LLM-driven discovery, configuration, and execution. Unlike APIs, the MCP server is built specifically for LLM consumption with robust descriptions and examples that return natural language responses. Refer to our documentation to learn more about the Slack MCP server.

Real-time Search API​

The Data Access API has evolved into the Real-time Search API! This API allows users to access Slack data through a secure search interface, enabling third-party applications to retrieve relevant Slack data without storing customer information on external servers. Get started using the Real-time Search API with this guide or get straight to business with the method reference.

Scope updates to assistant.search.context​

Along with these changes, the assistant.search.context API method has undergone a scope change. The assistant.search.context API method moved away from the single search:read scope to a set of granular search:read.* scopes:

• search:read.public (required) - for public channel access
• search:read.private - for private channels (with user consent)
• search:read.im - for direct messages (with user consent)
• search:read.mpim - for multi-party direct messages (with user consent)

This change allows for more granular control over what data AI-enabled apps can access.

• The task_card block displays a single task.
• The url source element displays clickable URL references within a task card.
• The plan block displays multiple of those tasks together in a unified view.

How tasks are displayed is set with a new parameter in the text-streaming API methods: task_display_mode. Use this to choose whether your app's tasks appear individually or in a comprehensive plan.

Then update the task cards and plan via the new chunks parameter. The parameter also supports plain markdown.

Ready to test it out? Check out our guide on developing AI apps, or jump straight to the text-streaming methods' reference pages:

• chat.startStream
• chat.appendStream
• chat.stopStream

• We've updated the slack create command to display "AI Agent app" instead of "AI app" to align with Slack's new Agent app features.
• We've added pyproject.toml support to Bolt for Python projects. The slack create and slack init commands will now detect pyproject.toml files, add the slack-cli-hooks<1.0.0 to the dependency section (when missing), and display instructions on how to install the dependencies. Python projects now support either or both of the requirements.txt and pyproject.toml files.
• We've updated the slack run command to support file watching and live reloading for Bolt for JavaScript and Bolt for Python projects. When a file is changed, the Slack CLI will automatically restart the app development server. When the manifest.json file is changed, the manifest update API is called (.slack/config.json must have manifest.source: "local").
• We fixed a bug: we removed support for the .slackignore file in the project root, as this file was unused. For posterity, during the Slack CLI Beta, this allowed Deno SDK projects to ignore files during deployment, but the feature was removed before Slack CLI v1.0.0.
• We fixed a bug: the slack app settings command now opens the App Settings home page (https://api.slack.com/apps) when the command is run outside of a project. This allows you to see your complete list of apps.
• We fixed a bug: we now print a debug log if the manifest file was changed but not reinstalled if the manifest.source was set to "remote".

• We made a few updates behind the scenes to keep things running smoothly. Happy New Year!

Classic apps will continue to work for the foreseeable future but are still considered a legacy method of integrating with Slack, and new classic apps cannot be created. We highly recommend you migrate your classic app to a Slack app to avoid any future service interruptions.

• We've added the slack app unlink command, which removes an existing App ID from your project (it will not delete the app from Slack).
• We've added support for read-only app collaborators (applicable to deployed Deno apps only):
  • To add a new collaborator as read-only, use the slack collaborator add --permission-type=reader command.
  • To update an existing collaborator to be read-only, use the slack collaborator update --permission-type=reader command.
  • To assign a collaborator as an owner, use the --permission-type=owner flag.

• We made a few updates behind the scenes to keep things running smoothly.
• The deno-slack-hooks version was updated to v1.5.0. This version adds support for bundling deno-slack-sdk projects with the new deno bundle command.

We made a few updates behind the scenes to keep things running smoothly.

The new and improved page replaces the old single-column OAuth experience with a brand new double-column, fully responsive view - making all of the configuration options and permissions details easier to read and understand while stepping through the OAuth flow.

We hope you enjoy the new experience!

Work Objects allow you to represent and collaborate on data from third-party services where the work is already happening, right in Slack. They have two primary components: an unfurl component, and a flexpane component.

We've also introduced a new entity_details_requested event and the entity.presentDetails API method, and have added support for Work Objects to the chat.unfurl API method. SDK support for these API updates is coming soon.

To learn how it all comes together to create a seamless experience for your users, check out the full documentation!

• Slack CLI now supports Work Objects. The manifest values for entity_types are now gathered when reading an app manifest.
• When reinstalling the Slack CLI after some time, we now avoid blocking the installation script with an automatic prompt to update to the latest version.

• We clarified your (relative lack of) responsibility for end user violations, noting that “complying with Slack’s Acceptable Use policy” included maintaining policies reasonably in line with it, but that applications are not responsible for violations by end users and that the breaches of your terms that trigger your obligation to notify Slack are security incidents or “known” breaches that could impact customers or users.
• The “Distribution Beyond Your Organization” section has always only applied to applications distributed beyond your organization (i.e., third-party apps, not custom internal ones), but we added more language throughout emphasizing that.
• We added the new “Real-Time Search API” to the “Data Access API” section, moved around the text to be clear that it applies to third parties only now that customers may access the Data Access API, and added some additional language on behavior such as temporary caching or storage required by law.