What OAuth Scopes are required for a listen & reply Slack Bot using the Slack Events API?

1
votes

I am trying to make a bot that will listen to all public & private channels, and IMs for a team, and will reply when it sees certain trigger words. This will be a "Slack App", installable to your team using the "Add to Slack" button, and includes a "Bot User".

I have asked for the "bot" OAuth scope, and subscribed to the "message.channels,message.groups and message.im" Team Events (at https://api.slack.com/apps/myAppId/event-subscriptions) but do not appear to receive event POSTs through the Events API when new messages are sent.

Adding the "channels:history,groups:history,im:history" scopes makes the bot receive these event POSTs, but I believe only for the user that added the bot, so it will not watch groups that the adding-user was not a member of, or IMs between 2 other users. This means that behaviour will be different, depending on which user installed my bot.

Is there a way of installing the app/bot for an entire team? The documentation seems to indicate that a 'bot' scope should have the ability to receive events, but I am not seeing this (I require the channels:history scope etc. above).

bot - request this scope when your Slack app includes bot user functionality. Unlike incoming-webhook and commands, the bot scope grants your bot user access to a subset of Web API methods, the RTM API, and certain event types in the Events API.

(from https://api.slack.com/docs/oauth-scopes)

The page on bots also claims that a bot can receive all messages through the RTM API:

This websocket will send you all of the messages and activity that happen in public and private channels that the bot user is invited to, as well as messages that are sent to it via direct message. A bot user opens this websocket with the RTM API by sending an authenticated call to the rtm.start API method. To learn more about connecting to the RTM API, read the documentation here. (from https://api.slack.com/bot-users)

Is this same behaviour possible in the events API without needing to use the RTM API or add those additional scopes mentioned above?

1
oauthslack-apislack
Since adding a bot user to my app, a 'Bot Events' section has appeared on the "Event Subscriptions" page where I can subscribe to "message.channels" and do not require the channels:history permission (contrary to the documentation). However, the bot user then needs to be invited to all of the channels I want to monitor, which makes the installation process more complex. – Crashthatch

1 Answers

0
votes

I see from your comment that you have understood that the bot scope (and the channels.message Events subscription) allows your bot to receive from channels it is present in.

You have two options 1) you ask for channel.write scope in addition to bot, and you invite the bot in all channels (using the user token, not the bot token) 2) you work on your onboarding and figure out a way to get your "champion", ie the user who installed your app, to invite your bot in relevant channel.

Keep in mind that solution 1) is usually seen as very intrusive, especially in large teams where most people haven't heard of your app nor taken the decision to install it. But it can be suitable for some very specific use cases. Option 2) is the recommended route, but it is hard :-) Good luck!