fix(slack): correct the Slack auth provider scope list [TOO-2091]

[EricGustin]

Closes TOO-2091 (with ArcadeAI/monorepo#3877)

The Slack auth provider page's scope list matched neither the Arcade Slack toolkit nor Arcade's own Slack app. Three separate drifts:

Scope	On the page	Required by a tool	Declared on Arcade's Slack app
groups:write	yes	only by the invite tool	no
mpim:write	yes	no	no
channels:write	no	by the invite tool	no

A customer following these instructions could read channels but not invite anyone, and Slack.InviteUsersToChannel re-issued an authorization URL on every call with no way to satisfy it. That is how this surfaced: an OpenTable escalation.

The correct scopes

Slack grants conversations.invite through channels:write.invites and groups:write.invites. The coarse channels:write and groups:write cover channel management only (archive, close, create, kick, leave, mark, rename, unarchive) and do not list conversations.invite on their own scope reference pages. Same for im:write and mpim:write. All four legacy write scopes omit it consistently.

conversations.invite's method page still lists the legacy pair, presumably for grandfathered grants, which is the stale side of that contradiction.

Also added

An explicit line that these go under User Token Scopes. Arcade requests Slack credentials as user tokens, so a scope declared only for a bot token is never granted, and the page did not say so anywhere.

Left alone deliberately

mpim:write stays. send_message in the toolkit has it commented out of its declared scopes while its MPIM path likely needs it at runtime, so dropping it from the setup instructions could break a working flow. Tracked separately.

toolkit-docs-generator/data/toolkits/slack.json still carries the old scopes. It is generated from the Engine API, so it refreshes on its own once the worker ships the toolkit change.

Sequencing

The matching toolkit change is ArcadeAI/monorepo#3877, which is itself blocked on TOO-2089 (adding these scopes to Arcade's production Slack app and the cloud engine allowlist). This page is instructions for customers bringing their own Slack app, so it is correct and useful as soon as the toolkit change ships, and harmless before then: the two new scopes are simply granted and unused.

---

Note

Low Risk
Documentation-only change to OAuth scope guidance; no runtime or auth code paths are modified.

Overview
Updates the Slack auth provider setup docs so the recommended OAuth scopes match what Arcade’s Slack tools actually need—especially inviting users to channels.

The scope list swaps coarse groups:write for channels:write.invites and groups:write.invites, which are what Slack uses to grant conversations.invite. Without those, customers following the page could authorize successfully for read/history flows but still fail InviteUsersToChannel with endless re-auth.

A new bullet tells readers to add every listed scope under User Token Scopes, not bot scopes, because Arcade obtains user tokens and bot-only scopes are never granted.

^{Reviewed by Cursor Bugbot for commit 3977286. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 3, 2026 5:43pm UTC