Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

Slack

Three levels: an app in one workspace (no review), unlisted public distribution (self-serve checklist), and Slack Marketplace listing (reviewed). Know which you need before starting.

Tier 3 · Review required30-90 min hands-onResearched 2026-10-20
DifficultyTier 3 · Review required

Sourced A single-workspace app is instant, but a commercial app that other companies install belongs on the Marketplace: it needs 10 active workspaces first, then a two-part manual review, and non-Marketplace commercial apps get stricter API rate limits. [e1][e7][e8]

Your time (hands-on)30-90 min

Inferred Our estimate: creating the app is quick, building and securing an OAuth flow with SSL URLs takes longer. No source states a time.

Approval waitUp to ~12 weeks

Sourced Slack states maximums, not typical times: up to 10 business days for the preliminary review plus up to 10 weeks for the functional review of a new submission (6 weeks for resubmitted published apps). Our sum is about 12 weeks. Slack says turnaround varies with volume. Unlisted distribution and single-workspace apps have no review. [e3][e4]

Composio managed authAvailable

Sourced Composio's Slack toolkit page lists OAuth2 and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits.

Open Composio's toolkit page

Who does what

An agent can

  • Walk the distribution checklist and verify your URLs are HTTPS.
  • Configure Composio once credentials exist.

You must

  • Create/own the Slack app.
  • Decide distribution level.
  • Handle Marketplace submission.

Steps

  1. Decide: managed or your own appYouSourced

    For prototyping use Composio Managed Auth (connect, pick workspace, Allow). Create your own app for custom branding, scopes or a dedicated quota. [e2]

    Why you: A product decision about branding and control.

  2. Create the Slack app and install it in your own workspaceYouSourced

    Install App to Workspace gives one token for that workspace, no OAuth code needed. [e1]

    Why you: Needs your signed-in Slack admin session.

  3. Build the OAuth flow if other workspaces need accessYou or agentSourced

    Needed for acting on behalf of other users or installing elsewhere. Composio handles this when you use its auth config with your own credentials. [e1][e2]

  4. Enable distributionYouSourced

    Manage Distribution > Share Your App with Other Workspaces > complete the checklist > Activate Public Distribution. Suitable for pilots. [e1]

    Why you: Needs your Slack app dashboard session and legal/security decisions.

  5. For commercial distribution, submit to the MarketplaceYouSourced

    Slack reviews listed apps against its requirements and guidelines. [e1]

    Why you: Submission and review communication are yours.

Requirements

  • Sourced To activate public distribution you must complete a checklist, including SSL on OAuth redirect, interactivity, select-options and Events API URLs. [e1]
  • Sourced You need an onboarding flow, since the user base can grow quickly. [e1]
  • Sourced Before submitting you need at least 10 installations on active workspaces, and Slack says to keep 10 or more installed through the whole review. [e7]
  • Sourced An active workspace is one used in the past 28 days. [e5]

Scopes and access

  • Sourced Request only the permissions the app truly needs; workspace admins weigh them during approval. [e1]

Review process

  • Sourced Review has automated tests, then a manual review in two parts: preliminary (is the app ready) and functional (installation and testing). [e3]
  • Sourced Preliminary feedback takes up to 10 business days; functional review takes up to 10 weeks for new submissions and 6 weeks for resubmitted published apps. [e3][e4]

Gotchas

  • Sourced Deactivating public distribution removes the app from every workspace that installed it except the original one. [e1]
  • Sourced After publishing in the Marketplace you cannot disable distribution the same way; you must discontinue the listing. [e1]
  • Sourced Composio's page lists a separate custom-app guide (composio.dev/auth/slack_custom) for your own Slack app; the main Slack guide gives no custom steps. [e2]
  • Sourced Slack applies reduced rate limits to newly created commercially distributed apps that are not Marketplace-approved (effective May 29, 2025). The page we read does not give the numbers. [e8]
  • Sourced Preliminary review resets your place in the queue each time you resubmit; the functional review does not. [e6]

If you get stuck

Inferred Cannot activate public distribution

Likely cause: Checklist incomplete, e.g. a required URL is not served over SSL.

Fix: Make every listed URL HTTPS and complete the checklist items.

Escalate when: Checklist is complete but activation stays disabled. [e1]

Next actions

  • If prototyping: use managed auth now.
  • If you need your own app: create it, install to your workspace, then decide whether unlisted or Marketplace fits.

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • Slack's review times are stated maximums ('up to'), not typical times; real timing was not observed.
  • The rate-limit page points to a changelog for the exact limits; the per-minute number was not read.
  • Slack's app-creation click path was not read; follow Slack's current docs.
  • How a team gets its first 10 active workspaces without being listed (unlisted distribution) is not detailed in the pages read.
  • No hands-on test logged yet.

Sources

  1. [e1] Slack Developer Docs - App distribution
    apps intended for commercial distribution should be submitted and approved for listing in the Slack Marketplace
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - Slack OAuth 2.0 setup
    Composio provides the Slack app, so there's nothing to configure.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] Slack Developer Docs - Marketplace review guide
    the preliminary part of the review takes up to 10 business days to receive feedback.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] Slack Developer Docs - Marketplace review guide
    the functional review takes up to 10 weeks for new submissions and 6 weeks for published apps resubmitting changes.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] Slack Developer Docs - Marketplace review guide
    An active workspace is a workspace that has been used in the past 28 days.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Slack Developer Docs - Marketplace review guide
    your place in the queue is reset each time you resubmit
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  7. [e7] Slack Developer Docs - Marketplace install requirement
    at least 10 installations on active workspaces
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  8. [e8] Slack Developer Docs - Rate limits
    all newly-created Slack apps that are commercially distributed and have not been approved for the Slack Marketplace
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  9. [e9] Composio docs - Slack toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.