Setting Up the Integration

Step 1: Create a Slack App

1. Go to api.slack.com/apps
2. Click Create New App → From scratch
3. Enter app name (e.g., “NodeKAT”) and select your workspace
4. Click Create App

Step 2: Configure Bot Token Scopes

The bot token is required and enables NodeKAT to read channel history and retrieve threads.

1. In your Slack App settings, go to OAuth & Permissions
2. Under Bot Token Scopes, add the following:

Scope	Description
channels:history	Read messages in public channels
channels:read	List public channels
groups:history	Read messages in private channels
groups:read	List private channels
users:read	Resolve user IDs to display names
users:read.email	Access user email addresses

Step 3: Configure User Token Scopes (Recommended)

The user token is optional but recommended. It enables native Slack search via the search.messages API, which is faster and returns higher-quality results than client-side channel scanning.

1. Still in OAuth & Permissions, under User Token Scopes, add:

Scope	Description
search:read	Search messages across the workspace
channels:read	List public channels
groups:read	List private channels
im:read	Read direct messages
mpim:read	Read group direct messages

Step 4: Install the App to Your Workspace

1. Go to OAuth & Permissions → click Install to Workspace (or Reinstall if updating scopes)
2. After installation, copy both tokens:

Token	Prefix	Where to Find
Bot User OAuth Token	xoxb-	OAuth & Permissions → Bot User OAuth Token
User OAuth Token	xoxp-	OAuth & Permissions → User OAuth Token

Step 5: Add the Bot to Channels

For each channel you want NodeKAT to access:

1. Open the channel in Slack
2. Type /invite @NodeKAT (or whatever you named your app)
3. The bot must be a channel member to read messages and search results

Next Steps

Provide the following credentials to your NodeKAT administrator:

• Bot User OAuth Token (xoxb-...) — required
• User OAuth Token (xoxp-...) — optional but recommended

Your administrator will configure NodeKAT to use these tokens.

Authentication Architecture

NodeKAT uses a dual-token security model:

	Bot Token (xoxb-)	User Token (xoxp-)
Required	Yes	No (recommended)
Used For	Channel history, thread retrieval, user resolution, channel discovery	Native Slack search (search.messages API)
Access Scope	Only channels the bot is a member of	All channels visible to the authorizing user
Search Mode	Client-side channel scanning (fallback)	Native Slack API search (preferred)

When both tokens are configured, NodeKAT uses the user token for searching but filters results to only include bot-accessible channels. This ensures the agent never surfaces content from channels the bot hasn’t been explicitly invited to.

Without a user token, NodeKAT falls back to scanning each bot-accessible channel individually using keyword matching and optional reranking.