Slack

Minutes to build, weeks to months to scale. Unlisted apps work in other workspaces, but history reads are throttled to 1 request/minute until Marketplace approval: up to 10 business days plus up to 10 weeks, and you need 10 active installs first.

Difficulty

3/5 · Moderate

Approval

listing review

Confidence

high

Test before approval

Yes

Why this score

• Slack Marketplace review (marketplace-review, weight 3)

• Check whether the throttle hits your agent (both) — done when: You know whether you need the Marketplace path.
• Create the app from a manifest (both) — done when: A bot token works in your workspace.
• Enable distribution and wire Composio (both) — done when: A second workspace can install via your auth config.

• highUnlisted commercial apps read channel history at 1 request/minute and 15 objects per call. An agent that summarizes channels is effectively unusable at scale. (Pilot-ready)Workaround: Pilot with few workspaces, or have a single customer build an internal app (not throttled). The real fix is Marketplace approval.
• highThe Marketplace needs 10 active installs held through the whole review, which you must recruit while still throttled. (Production-ready)Workaround: Line up design partners before submitting.
• mediumMarketplace review takes up to 10 business days plus up to 10 weeks, and Slack won't accelerate it. (Production-ready)Workaround: Submit as early as possible; keep the reviewer test workspace working.An agent can help with this.

• A Slack workspace where you can install apps (human · Dev-ready): Development happens in the app's associated workspace.
• HTTPS redirect URL (both · Pilot-ready): The redirect_uri must use HTTPS and match, or be a subdirectory of, a Redirect URL configured in App Management. Use the Composio dashboard's URL.
• 10 active workspace installs (human · Production-ready): Needed to submit to the Marketplace, and must hold through the whole review, while you are still throttled.

• Create a Slack app (self serve)Applies when: always. Required for Pilot-ready.
• Non-Marketplace commercial app rate limit (1 req/min, 15 objects on conversations.history/replies) (listing throttle)Applies when: unlisted commercial distribution. Required for Pilot-ready.Duration: Lasts until the app is approved for the Slack Marketplace. Internal customer-built apps are not affected.primarysource
• Slack Marketplace review (marketplace review)Applies when: to escape the non-Marketplace throttle. Required for Production-ready.Duration: Up to 10 business days for preliminary feedback, then up to 10 weeks for the functional review (6 weeks for resubmissions).primarysourceCost: Prerequisite: at least 10 installations on active workspaces, maintained for the whole review.primarysource

1. Check whether the throttle hits your agent (decide · both · ~10 min)
   • List the Web API methods the agent calls. If it uses conversations.history or conversations.replies across many workspaces, plan for the Marketplace.
   • If only one customer uses it, consider an internal app built in their workspace (not throttled).
   Done when: You know whether you need the Marketplace path.
2. Create the app from a manifest (create · both · ~10 min)
   • api.slack.com/apps → Create New App → From a manifest.
   • Paste a manifest with bot scopes and the HTTPS redirect URL.
   • Install to your workspace.
   Done when: A bot token works in your workspace.
3. Enable distribution and wire Composio (configure · both · ~15 min)
   • Manage Distribution → activate public (unlisted) distribution.
   • Decide on token rotation now: once on it can't be turned off, and access tokens then expire every 12 hours.
   • Copy client ID and secret into a Composio auth config.
   Done when: A second workspace can install via your auth config.
4. Reach 10 installs and submit to the Marketplace (submit · both)
   • Recruit at least 10 active workspaces and keep them installed.
   • Prepare listing copy, privacy policy and support pages; submit and answer reviewer feedback.
   Done when: The app is approved for the Slack Marketplace.

Redirect URIs:

HTTPS only; the redirect_uri must match or be a subdirectory of a configured Redirect URL.primarysource

PKCE:

Supported, but enabling it marks the app as a public client, which can't be undone without Slack support. Server-side agents usually don't need it.primarysource

Token lifetime:

Without token rotation, access tokens never expire. With rotation they expire every 12 hours.primarysource

Refresh:

Token rotation is opt-in and can't be turned off once enabled.primarysource

Rate limits:

Unlisted commercial apps: conversations.history/replies at 1 request/minute and 15 objects (Tier 1 instead of Tier 3).primarysourceOther Web API methods follow per-method tiers (Tier 1: 1+ per minute … Tier 3: 50+ per minute).primarysource

• GET https://slack.com/.well-known/openid-configuration → 200OIDC discovery for Sign in with Slack (authorization_endpoint https://slack.com/openid/connect/authorize). The app OAuth v2 flow uses slack.com/oauth/v2/authorize instead. (2026-10-19T20:37:18Z)
• GET https://slack.com/oauth/v2/authorize?client_id=oauth-atlas-probe&scope=channels:history&redirect_uri=https%3A%2F%2Fexample.com%2Fcb&tracked=1 → 302 → https://slack.com/workspace-signin?redir=%2Foauth%3Fclient_id%3Doauth-atlas-probe...Authorize endpoint is live; unauthenticated requests go to workspace sign-in before the client_id is validated. The first request (without tracked=1) returned 200 with a JS redirect. (2026-10-19T20:37:43Z)

• [ev-dist] New apps install only in their associated workspace by default; unlisted distribution is meant for pilots. primary high confidence

  By default, a newly built Slack app can only be installed in its associated workspace as mentioned above.

  https://docs.slack.dev/distribution/official-doc · retrieved 2026-10-19T20:43:29Z
• [ev-throttle] Non-Marketplace commercial apps get 1 req/min and 15 objects on conversations.history/replies. primary high confidence

  The new rate limits will be updated to allow 1 request per minute and will return a maximum of 15 objects per request.

  https://docs.slack.dev/changelog/2025/05/29/rate-limit-changes-for-non-marketplace-appsofficial-doc · retrieved 2026-10-19T20:43:32Z
• [ev-review] Marketplace review: up to 10 business days preliminary, up to 10 weeks functional; no acceleration. primary high confidence

  Currently, the preliminary part of the review takes up to 10 business days to receive feedback, while the functional review takes up to 10 weeks for new submissions and 6 weeks for published apps resubmitting changes.

  https://docs.slack.dev/slack-marketplace/slack-marketplace-review-guideofficial-doc · retrieved 2026-10-19T20:43:34Z
• [ev-installs] Marketplace submissions need at least 10 active workspace installs, held through review. primary high confidence

  As of July 2026, we require that apps submitting to the Slack Marketplace have at least 10 installations on active workspaces, up from the temporary lower threshold.

  https://docs.slack.dev/changelog/2026/09/01/slack-marketplace-install-requirementofficial-doc · retrieved 2026-10-19T20:43:35Z
• [ev-redirect] The redirect_uri must use HTTPS. primary high confidence

  The redirect_uri must use HTTPS.

  https://docs.slack.dev/authentication/installing-with-oauthofficial-doc · retrieved 2026-10-19T20:43:38Z
• [ev-rotation] With token rotation, access tokens expire every 12 hours; rotation can't be turned off. primary high confidence

  With token rotation, it expires every 12 hours.

  https://docs.slack.dev/authentication/using-token-rotationofficial-doc · retrieved 2026-10-19T20:43:40Z
• [ev-pkce] Enabling PKCE makes the app a public client, one-way. primary high confidence

  It cannot be disabled without contacting Slack support.

  https://docs.slack.dev/authentication/using-pkceofficial-doc · retrieved 2026-10-19T20:45:13Z
• [ev-internal-exempt] Internal customer-built apps keep their existing rate limits. primary high confidence

  Any internal customer-built apps will maintain their existing rate limits and will not be subject to the new posted limits.

  https://docs.slack.dev/changelog/2025/06/03/rate-limits-clarityofficial-doc · retrieved 2026-10-19T20:46:53Z
• [ev-probe-authorize] slack.com/oauth/v2/authorize is live and routes unauthenticated users to workspace sign-in. tested high confidencehttps://slack.com/oauth/v2/authorizetest · retrieved 2026-10-19T20:37:43Z

• Whether Composio's managed Slack app is Marketplace-listed (and so exempt from the history throttle).
• Research.md reported (secondary) that the throttle was extended to existing installs from 2026-03-03. The official 2025-05-29 entry and its 2025-06-03 clarification (internal customer-built apps keep existing limits) say nothing about such an extension; we found no official confirmation.
• Marketplace minimum review time: Slack publishes only upper bounds.
• Whether a Marketplace listing has any fee (none found).

• 2026-10-20: Slack distribution — Unlisted distribution is enough for production. → Unlisted commercial apps get 1 req/min and 15 objects on conversations.history/replies; lifting that needs Marketplace approval, which needs 10 active installs and up to 10 business days plus up to 10 weeks. (Slack's 2025-05-29 rate-limit change and the July 2026 install requirement.)