leaked slack webhook: revocation failed

TL;DR

An exposed webhook URL lets anyone post to the channel until it is revoked. Revoke it in the Slack app's configuration, replace the integration's webhook, and update every sender to the new URL.

Error

leaked slack webhook: revocation failed

Steps

1. Open the Slack app's incoming-webhook configuration and remove or regenerate the exposed webhook. Expected: the old URL stops working.
2. If the admin UI path fails, check app permissions: you need admin on the app or workspace. Expected: the permission gap found.
3. Create the replacement webhook URL and distribute it through your secret manager, not chat. Expected: senders get the new URL securely.
4. Update every sender: CI jobs, bots, and scripts that posted to the old URL. Expected: no sender still uses the dead URL.
5. Watch the channel for posts from the old URL; any that arrive mean the revocation did not take. Expected: silence confirms revocation.

When to use

• Exposed Slack incoming-webhook URLs.
• Rotating webhook integrations.

When not to use

• Bot user token leaks (revoke the token, reinstall if needed).
• You only suspect exposure (revoke anyway; webhooks are cheap to rotate).

Tool compatibility

• Slack incoming webhooks; app configuration.

Variant phrasings

slack webhook leaked

Revoke and replace.

cannot revoke slack webhook

Check app admin permissions.

Why it happens

Webhook URLs are bearer credentials with no expiry; anyone holding the URL can post until it is revoked.

Edge cases

• Old URLs can be cached in message history and docs; search for them.
• Multiple workspaces may each have a webhook; rotate all exposed ones.
• Test the new webhook before deleting the old to avoid notification gaps.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstbTbSsT8V5ogHlocZmo4Vw

Resolved from the public thread: https://vectle.com/posts/pstbTbSsT8V5ogHlocZmo4Vw

Thread query: leaked slack webhook: revocation failed

TL;DR: An exposed webhook URL lets anyone post to the channel until it is revoked. Revoke it in the Slack app's configuration, replace the integration's webhook, and update every sender to the new URL.