Review gate (commercial)

Communication·curated + hand-verified·checked 2026-10-28

Slack

difficulty

3/5

Build and install in under an hour. Selling to other companies means Marketplace approval, which requires 10 active workspaces before you can even submit and up to ~10 weeks of review. Unlisted apps get 1 req/min on message history.

First working connection

~30 minutes (your own workspace)

Production / approved

Unlisted pilot: same day · Marketplace: ~2–3 months incl. 10-install prerequisite

Composio managed OAuth

Available: ship today

Composio offers a managed Slack app. Your own app gives you your bot name/icon and your own rate limits, and is what Marketplace review is about.

who does itagent 3you 4provider 0

evidencetested 3sourced 23inferred 5

01Pick your path

Single workspace (internal)

when The agent only runs in your own company's Slack.

→ No review. Full rate limits. One-click install generates a token.

Unlisted distribution

when Pilots with early customers.

→ Other workspaces can install via 'Add to Slack'. conversations.history/replies are limited to 1 request/min for new commercial installs.

Slack Marketplace

when Commercial distribution, which Slack's terms say is the only appropriate channel.

→ Manual review: preliminary (≤10 business days) + functional (≤10 weeks). Full rate limits.

02Time & effort

Hands-on work

6.2 h – ~2 workdays

Waiting on others

5 weeks – 20 weeks

You're actually working

<1% of elapsed time

Phases

start↑ first working connection, then production pathproduction

DEVCreate app from manifest + install to your workspace10–30 minutessourced[slack-manifest][slack-dist]
PRODBuild OAuth install flow (multi-workspace, state param, HTTPS redirect)2–6 hoursinferred[slack-dist]
PRODReach 10 active workspaces (prerequisite to submit)wait 2–8 weeksinferred[slack-review]The requirement is sourced. How long it takes you depends on your go-to-market.
PRODListing assets, test account, demo video4–8 hourssourced[slack-review]
PRODPreliminary reviewwait 1–2 weekssourced[slack-review]Up to 10 business days. The queue resets on each resubmission.
PRODFunctional reviewwait 2–10 weekssourced[slack-review]'Up to 10 weeks' for new submissions. Slack won't expedite.

agent can do it you waiting on providerbar widths ∝ √time, so short tasks stay visible

03Steps

0/7 done

Get a working connection

Create the app from a manifest (pre-filled link)agentsourced[slack-manifest]

Slack accepts a manifest in the create-app URL, so an agent can generate the full config (scopes, redirect URLs, bot user) and you just pick a workspace and confirm.

◆ prepared by agent · Create Slack app from this manifest

open ↗

https://api.slack.com/apps?new_app=1&manifest_json={"display_information":{"name":"My Agent","description":"AI agent that works in your Slack"},"features":{"bot_user":{"display_name":"My Agent","always_online":true}},"oauth_config":{"redirect_urls":["https://example.com/slack/oauth/callback"],"scopes":{"bot":["chat:write","channels:read","app_mentions:read"]}},"settings":{"org_deploy_enabled":false,"socket_mode_enabled":false}}

Install to your workspace and testyousourced[slack-dist]
Install App → Install to Workspace gives you a bot token for your own workspace with no OAuth code needed.
↗ api.slack.com/apps

Make it production-ready

Implement OAuth v2 for other workspacesagentsourced[slack-dist][slack-review]
Required before any other workspace can install. All redirect URLs must be HTTPS. Use the state parameter. For Enterprise installs, check the user's domain matches the customer.
Activate public (unlisted) distributionyousourced[slack-dist]
Manage Distribution → Activate Public Distribution. You get an 'Add to Slack' button and a shareable install URL. It's also a prerequisite for Marketplace submission.
Get 10+ active workspaces using ityousourced[slack-review]
Marketplace submission is blocked until the app is installed on ≥10 workspaces active in the last 28 days.
Prepare submission: scope reasons, test account, demo videoagentsourced[slack-review]
Reviewers need test credentials (paid tier if required) with dummy data, and a video of install → OAuth → setup → use → uninstall. Only request scopes for features that exist today. An agent can draft scope reasons and the video script.
Submit to Slack Marketplaceyousourced[slack-review]
From the app's 'Submit to the Slack Marketplace' section. Check the estimated review time shown on the submission page.

04Requirements, scopes & nuances

You'll need

▸HTTPS for all OAuth redirect URLs once the app is installable by other workspaces. sourced[slack-dist]
▸Marketplace: ≥10 active workspace installs before submission. sourced[slack-review]
▸Marketplace: production-ready app, test credentials, and ideally a demo video. sourced[slack-review]
▸Marketplace: app meets the listing guidelines. Some app categories are not accepted. sourced[slack-guidelines]

Gotchas

!Since May 2025, conversations.history and conversations.replies are limited to 1 request/min for commercially distributed non-Marketplace apps. That's crippling for agents that read context. sourced[slack-rl]
!Slack's API terms say the Marketplace is the only appropriate channel for commercial distribution. Unlisted is for pilots. sourced[slack-rl][slack-dist]
!Every resubmission during preliminary review puts you back in the queue. sourced[slack-review]
!Don't request scopes for future features. Reviewers only approve what they can test, and adding scopes later forces users to reinstall. sourced[slack-review]
!Some workspaces only allow Marketplace apps or require admin approval, so unlisted apps may be blocked at install. sourced[slack-dist]

Scope / permission	Tier	Note	Evidence
chat:write	basic	Post messages as the bot.	inferred
app_mentions:read	basic	React when @mentioned.	inferred
channels:history / conversations.history	gated	Unlisted commercial apps: 1 request/min. Marketplace apps keep normal limits.	sourced[slack-rl]

05If you get blocked

✕Agent can't read enough history (rate-limited).inferred[slack-rl]

→ Use events (message.* subscriptions) instead of polling history, cache aggressively, and prioritize Marketplace approval. Internal apps are unaffected.

✕Can't submit: fewer than 10 active installs.sourced[slack-review][composio]

→ Run unlisted pilots with design partners first. Launching on the managed Composio Slack app meanwhile doesn't count toward your app's installs.

✕Customer's workspace blocks the install.sourced[slack-dist]

→ Ask their admin to approve the app request (admin approval flow), or wait for Marketplace listing.

06Evidence: what was tested, sourced, and still uncertain

$ probes: live GETs with a dummy client_id, no credentials

✓ OIDC discovery document → 200

https://slack.com/.well-known/openid-configuration

authorization_endpoint = https://slack.com/openid/connect/authorize

∴ Sign in with Slack (OIDC) is available. Bot installs use /oauth/v2/authorize instead.

✓ OAuth v2 authorize with a fake client_id → 200

https://slack.com/oauth/v2/authorize?client_id=probe_invalid&scope=channels:read

Returns an HTML page (no redirect)

∴ Endpoint is live. Slack renders its error/sign-in page rather than an HTTP error.

✓ Old docs URL → 200

https://docs.slack.dev/distribution

Page renders a 404 ('West of a white house')

∴ Slack moved docs to docs.slack.dev/app-management/distribution/. Old links in blogs are stale.

Sources read

[slack-dist] Slack — App distribution official
[slack-review] Slack — Marketplace review guide official
[slack-guidelines] Slack — Marketplace app guidelines and requirements official
[slack-rl] Slack changelog — 2025 terms & rate-limit update FAQ official
[slack-manifest] Slack — Configuring apps with app manifests official
[composio] Composio — Managed OAuth apps directory official
[probe] Live HTTP probes run by the agent (dummy client_id, no credentials) probe

Still uncertain

? Review times are Slack's stated maximums ('up to'). Actual times vary with volume, and the submission page shows a live estimate.
? Time to reach 10 active installs depends entirely on your distribution.
? We did not create a real Slack app. The manifest link format is from Slack's docs, not a recorded click-through.