Skip to main content

Slack authentication

Not yet available (2.4.x)

The Slack provider is not enabled yet. Only Google is live right now — calling auth.signIn() with this provider throws AuthErrorCode.PROVIDER_NOT_ENABLED. The page below documents its intended shape for when it is re-enabled. See the provider overview and the Google provider.

The Slack provider signs users in with a manual OAuth authorization-code flow protected by S256 PKCE. After the code exchange it fetches the real profile from Slack's OpenID Connect openid.connect.userInfo endpoint.

When you need a backend​

A backend is optional. The PKCE-protected code flow can complete in the browser. If your Slack app configuration requires a client secret for the token exchange, keep that secret on a server — do not embed clientSecret in the browser bundle.

Configuration​

import { auth } from 'capacitor-auth-manager';

auth.configure({
  providers: {
    slack: {
      clientId: 'YOUR_SLACK_CLIENT_ID',
      redirectUri: 'https://your-app.com/auth/slack/callback',
      scopes: ['openid', 'profile', 'email'],
      teamId: 'OPTIONAL_TEAM_ID',
    },
  },
});

Options​

From the SlackAuthOptions interface in src/definitions.ts:

OptionTypeRequiredPurpose
clientIdstringYesSlack app client ID.
redirectUristringYesRedirect URI registered with the Slack app.
clientSecretstringNoServer-side only — keep out of the browser bundle.
scopesstring[]NoOpenID Connect scopes to request (e.g. openid, profile, email).
teamIdstringNoRestrict sign-in to a specific Slack workspace.
statestringNoCSRF state value.
noncestringNoOIDC nonce.

Sign in​

await auth.signIn('slack');

Notes & caveats​

  • The flow uses S256 PKCE (code_challenge_method=S256) generated by the library.
  • The profile is fetched from https://slack.com/api/openid.connect.userInfo; a network failure there surfaces as a clear error.
  • teamId limits sign-in to one workspace; omit it to allow any workspace the app is installed in.
  • The library does not verify ID-token signatures in the browser — re-validate server-side if you trust the claims.