slack bot token invalid_auth after app reinstall

Fix Slack invalid_auth after reinstalling the app

TL;DR

Reinstalling a Slack app rotates its tokens: the old bot token stored in the deployment is now dead, which is why every API call returns invalidauth. Copy the new bot token from the app's OAuth page into the deployment configuration and restart the app. Treat every reinstall as a token rotation, and add an invalidauth alert so the next one pages instead of failing silently.

The error

{"ok": false, "error": "invalid_auth"}
Every Slack Web API call fails immediately after the app was reinstalled

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=slack%20bot%20token%20invalid_auth%20after%20app%20reinstall"

Fix it

Step 1: Copy the current bot token from the app page

Open api.slack.com/apps / [app] / OAuth and Permissions and copy the Bot User OAuth Token (starts with xoxb-).

Expected: a value different from what is deployed. That difference is the whole problem.

Step 2: Update the token everywhere it is stored

Write the new token into the deployment's secret store or environment variables - every environment, not just production.

Expected: no environment still holds the old value. Staging forgotten is the classic repeat outage.

Step 3: Restart so the new value loads

Restart the app and background workers so they pick up the new configuration.

Expected: no cached old token remains in any process.

Step 4: Verify with auth.test

curl -s -X POST https://slack.com/api/auth.test -H "your auth header bot token value]" | head -c 200

Expected: a JSON response with ok true. If it still fails, the token was copied wrong or the wrong app's page was used.

Step 5: Add a reinstall checklist and alerting

Add "rotate the stored Slack token" to the app-reinstall runbook, and alert on invalid_auth responses so the next rotation pages immediately.

Expected: the next reinstall is a routine step, not an outage.

When this applies

• invalid_auth on all calls right after a reinstall
• The token in the deployment differs from the app page
• One environment works while another fails

When it doesn't

• invalid_auth without any reinstall (token revoked by admin or leaked and revoked)
• Calls fail with missing_scope (permission issue, not token issue)
• Only some calls fail (endpoint-specific problem)

Compatibility

Slack Web API, OAuth v2 bot tokens (xoxb-). Same mechanics for user tokens (xoxp-).

Variant phrasings

slack api invalid_auth token revoked

If no reinstall happened, check whether an admin revoked the token or Slack revoked it for a leak.

slack bot token stopped working after reinstall

Same fix. Reinstall always rotates; there is no "keep my token" option.

Why it happens

Slack invalidates prior tokens when an app is reinstalled, as a security measure: a reinstall implies the trust relationship was re-established, so old credentials must die. The deployed configuration still holds the dead token, so every call fails auth. The failure is total and immediate, which is actually the helpful signature - partial failures would point elsewhere.

Edge cases

• User tokens rotate too; check both if the integration uses them
• Each workspace installation has its own token; multi-workspace apps rotate per workspace
• Tokens in logs must be redacted; grep the codebase for the old value to find every copy

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_p3dIIYcnsbV7GFRj4qiFdQ