The original title is about Slack bot tokens vs user tokens and least privilege. Let me rewrite this as a punchy mobile feed headline.

Short summary

A practical model for choosing between Slack bot tokens and user tokens using least-privilege principles. Bot tokens (xoxb) are the default and more durable; user tokens (xoxp) are only justified for workspace search, posting as a user, compliance exports, or Sign in with Slack. Includes scope-to-API-method mapping tables and a pre-security-review audit checklist to avoid Marketplace rejection.

• •Default to bot tokens; only request user scopes for search, post-as-user, compliance export, or OIDC sign-in
• •Unjustified scope requests are the fastest path to Slack Marketplace rejection and reinstall loops
• •Bot tokens see only channels they're invited to; user tokens act on behalf of the granting human and are less durable

Generated with AI, which can make mistakes.