---

summary: "Slack setup and runtime behavior (Socket Mode + HTTP Request URLs)"

summary: "Slack setup and runtime behavior (Socket Mode, HTTP Request URLs, and relay mode)"

read_when:

- Setting up Slack or debugging Slack socket/HTTP mode

- Setting up Slack or debugging Slack socket, HTTP, or relay mode

title: "Slack"

---

Production-ready for DMs and channels via Slack app integrations. Default mode is Socket Mode; HTTP Request URLs are also supported.

Production-ready for DMs and channels via Slack app integrations. Default mode is Socket Mode; HTTP Request URLs are also supported. Relay mode is intended for managed deployments where a trusted router owns Slack ingress.

<CardGroup cols={3}>

<Card title="Pairing" icon="link" href="/channels/pairing">

**Pick HTTP Request URLs** when running multiple Gateway replicas behind a load balancer, when outbound WSS is blocked but inbound HTTPS is allowed, or when you already terminate Slack webhooks at a reverse proxy.

</Note>

### Relay mode

Relay mode separates Slack ingress from the OpenClaw gateway. A trusted router owns the

single Slack Socket Mode connection, chooses a destination gateway, and forwards a typed

event over an authenticated websocket. The gateway continues to use its bot token for

outbound Slack Web API calls.

```json5

{

channels: {

slack: {

mode: "relay",

botToken: { source: "env", provider: "default", id: "SLACK_BOT_TOKEN" },

relay: {

url: "wss://router.example.com/gateway/ws",

authToken: { source: "env", provider: "default", id: "SLACK_RELAY_AUTH_TOKEN" },

gatewayId: "team-gateway",

},

},

},

}

```

The relay URL must use `wss://` unless it targets localhost. Treat the bearer token and

router route table as part of the Slack authorization boundary: routed events enter the

normal Slack message handler as authorized activations. A router-provided `slack_identity`

in the websocket `hello` frame can set the default outbound username and icon; an explicit

identity supplied by the caller still wins. The relay connection reconnects with the same

bounded backoff timing used by Socket Mode and clears the router-provided identity whenever

it disconnects.

## Install

Install Slack before configuring the channel:

- `botToken` + `appToken` are required for Socket Mode.

- HTTP mode requires `botToken` + `signingSecret`.

- `botToken`, `appToken`, `signingSecret`, and `userToken` accept plaintext

- Relay mode requires `botToken` plus `relay.url`, `relay.authToken`, and `relay.gatewayId`; it does not use an app token or signing secret.

- `botToken`, `appToken`, `signingSecret`, `relay.authToken`, and `userToken` accept plaintext

strings or SecretRef objects.

- Config tokens override env fallback.

- `SLACK_BOT_TOKEN` / `SLACK_APP_TOKEN` env fallback applies only to the default account.