Slack Workflow Automation & Best Practices

Workflow Builder (No-Code)

• Workflow Builder: Automations → Workflow Builder — create workflows without code

• Triggers: message shortcut, emoji reaction, scheduled time, webhook

• Steps: send message, create channel, update topic, call webhook, custom step

• Custom steps: published as part of your Slack app — appear in Workflow Builder for all users

• Variables: pass data between steps (user name, message text, channel)

Useful Notification Patterns

// Alert with severity color (attachments for color sidebar)
await slack.chat.postMessage({
  channel: '#alerts',
  attachments: [{
    color: severity === 'critical' ? '#FF0000' : '#FFA500',
    blocks: [
      {
        type: 'section',
        text: { type: 'mrkdwn', text: `*[${severity.toUpperCase()}]* ${message}` }
      }
    ]
  }]
})

// Threaded updates — keep channel clean
const { ts } = await slack.chat.postMessage({ channel, text: 'Starting deploy...' })
// ... later ...
await slack.chat.postMessage({ channel, thread_ts: ts, text: 'Step 1 complete' })
await slack.chat.postMessage({ channel, thread_ts: ts, text: 'Deploy finished!' })

// Ephemeral message — only visible to one user
await slack.chat.postEphemeral({
  channel,
  user: userId,
  text: 'Only you can see this error details',
})

Rate Limits & Error Handling

• Tier 1 (1 req/min): conversations.create, etc.

• Tier 2 (20 req/min): most Web API methods

• Tier 3 (50 req/min): chat.postMessage, reactions.add

• Tier 4 (100 req/min): high-frequency methods

• Rate limit response: HTTP 429 with Retry-After header

• @slack/web-api retries automatically with exponential backoff by default

• Workspace limits: 1 message/second per channel — batch or queue notifications

Security

• Verify request signatures: X-Slack-Signature header prevents spoofed requests — Bolt does this automatically

• Never expose Bot Token client-side — always make Slack API calls from backend

• Use short-lived trigger_ids (valid 3s) — open modals immediately after ack()

• Store tokens encrypted — use Slack's token rotation for long-lived installations

• Restrict app scopes to minimum required — don't request channels:history unless needed

Development Tips

# ngrok for local development (exposes localhost to Slack)
ngrok http 3000
# Use the https URL in Slack app settings → Event Subscriptions

# Socket Mode for development (no ngrok needed)
# Enable in Slack app settings → Socket Mode

# Slack CLI (official)
npm install -g @slack/cli
slack login
slack create my-app
slack run      # local development with hot reload
slack deploy   # deploy to Slack hosting