# Fix Slack invalid_auth after reinstalling the app

## TL;DR
Reinstalling a Slack app rotates its tokens: the old bot token stored in the deployment is now dead, which is why every API call returns invalid_auth. Copy the new bot token from the app's OAuth page into the deployment configuration and restart the app. Treat every reinstall as a token rotation, and add an invalid_auth alert so the next one pages instead of failing silently.

## The error
```text
{"ok": false, "error": "invalid_auth"}
Every Slack Web API call fails immediately after the app was reinstalled
```

## Use this skill
Agent? Search Vectle for this error:
```bash
curl -s "https://vectle.com/api/v1/search?q=slack%20bot%20token%20invalid_auth%20after%20app%20reinstall"
```

## Fix it

### Step 1: Copy the current bot token from the app page

```bash
Open api.slack.com/apps / [app] / OAuth and Permissions and copy the Bot User OAuth Token (starts with xoxb-).
```

Expected: a value different from what is deployed. That difference is the whole problem.

### Step 2: Update the token everywhere it is stored

```bash
Write the new token into the deployment's secret store or environment variables - every environment, not just production.
```

Expected: no environment still holds the old value. Staging forgotten is the classic repeat outage.

### Step 3: Restart so the new value loads

```bash
Restart the app and background workers so they pick up the new configuration.
```

Expected: no cached old token remains in any process.

### Step 4: Verify with auth.test

```bash
curl -s -X POST https://slack.com/api/auth.test -H "your auth header bot token value]" | head -c 200
```

Expected: a JSON response with ok true. If it still fails, the token was copied wrong or the wrong app's page was used.

### Step 5: Add a reinstall checklist and alerting

```bash
Add "rotate the stored Slack token" to the app-reinstall runbook, and alert on invalid_auth responses so the next rotation pages immediately.
```

Expected: the next reinstall is a routine step, not an outage.

## When this applies

- invalid_auth on all calls right after a reinstall
- The token in the deployment differs from the app page
- One environment works while another fails

## When it doesn't

- invalid_auth without any reinstall (token revoked by admin or leaked and revoked)
- Calls fail with missing_scope (permission issue, not token issue)
- Only some calls fail (endpoint-specific problem)

## Compatibility

Slack Web API, OAuth v2 bot tokens (xoxb-). Same mechanics for user tokens (xoxp-).

## Variant phrasings

### slack api invalid_auth token revoked

If no reinstall happened, check whether an admin revoked the token or Slack revoked it for a leak.

### slack bot token stopped working after reinstall

Same fix. Reinstall always rotates; there is no "keep my token" option.

## Why it happens

Slack invalidates prior tokens when an app is reinstalled, as a security measure: a reinstall implies the trust relationship was re-established, so old credentials must die. The deployed configuration still holds the dead token, so every call fails auth. The failure is total and immediate, which is actually the helpful signature - partial failures would point elsewhere.

## Edge cases

- User tokens rotate too; check both if the integration uses them
- Each workspace installation has its own token; multi-workspace apps rotate per workspace
- Tokens in logs must be redacted; grep the codebase for the old value to find every copy

## If it still fails

- Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
- Reproduce with a single test user so you are not debugging a crowd.
- If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

## Prevention

- Track credential and certificate expiry with alerts, not memory.
- Run a synthetic check per app daily so breakage pages you, not a user.
- Document mappings, URLs, and runbook steps where the next admin will find them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_p3dIIYcnsbV7GFRj4qiFdQ