Organizations of all sizes and industries look to Slack to get work done, from digital native companies like Airbnb and Uber to Fortune 100 cornerstones like Target and Oracle. For developers, this means as Slack grows, you grow with us — sharing our customers and joining us in changing the way teams collaborate.

Managing apps can get complex, especially for Enterprise Grid customers who use multiple workspaces to connect their organization. Today we’re excited to release org-wide app deployment, making it possible for Slack apps to be installed at the org level and swiftly added to multiple workspaces at once.

Easing the administrative overhead for your app goes a long way in helping you gain adoption with enterprise customers. Read on to learn more, and be sure to register for our upcoming webinar on building secure, scalable apps for Enterprise Grid.

Drive adoption at scale

With org-wide app deployment, admins no longer need to install an app multiple times across workspaces — all of that work gets centralized in a handy dashboard.

On average, Enterprise Grid customers manage 52 workspaces with some juggling upwards of 8,000 workspaces in a single organization. By streamlining the installation process into one simple flow, you eliminate hours of administrative work getting your app set up and increase the odds of your app getting deployed to more workspaces.

Be part of the Slack experience from day one

When installing an app at the org level, Enterprise Grid customers will also have the opportunity to set apps as default so they are automatically installed on future workspaces. This creates a persistent growth engine for your app, ensuring every new user joining each new workspace can start engaging with your app without any friction.

Simplify token management

As a developer, authentication and token management can get messy, especially when handling users across multiple workspaces. With org-wide app deployment, your app is issued a single token at the org level, representing your app’s access to all workspaces and users within the Enterprise Grid organization.

This also means users will only need to authenticate with your app once at the org level, creating a smoother, consistent experience as they engage with your app across workspaces.

Tips for building enterprise-ready apps

Supporting org-wide app deployment isn’t the only thing needed to ensure your app is enterprise-ready. As you chart your plan for supporting org-wide app deployment, pause and take a moment to evaluate your broader app architecture. Ask yourself questions like:

• Does my app use granular permissions as a less permissive, more secure app foundation?
• Does my app recognize when it’s used in a workspace in an Enterprise Grid organization?
• Does my app know how to handle global IDs (mapped to an Enterprise Grid organization) versus local IDs (mapped to a workspace)?
• Does my app work in channels shared between organizations in Slack Connect?

Getting started

You can start building an org-deployable app today. Visit Slack API for documentation, and be sure to try our first-party app framework, Bolt, which helps you jumpstart the process of building an enterprise-ready app in JavaScript, Java, and Python.

Looking for more guidance? Join our upcoming webinar on building secure, scalable apps for Enterprise Grid. We can’t wait to see what you build!

Need help? Shoot us an email at feedback@slack.com with any questions.

Building (and scaling) enterprise-grade apps was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Slack Connect is a new, more secure and productive way for organizations to work together. It makes collaborating with external partners in Slack as simple as with your own team — replacing email and streamlining teamwork for everyone.

More than 41,000 organizations rely on Slack Connect to collaborate with clients, partners, vendors and more. For developers, these connections are a discovery driver.

Optimizing your app for Slack Connect means everyone in the channel can see your app’s capabilities in action — regardless of whether those collaborators have your app installed on their own workspace. It’s also a chance to explore how your app can benefit multiple organizations working together in the Slack Connect environment.

Here are a few examples of how different developers have put this into practice.

Increasing calendar visibility across company lines

Scheduling a meeting with a coworker just takes a few clicks to see their calendar. Finding time with external partners? That requires a seemingly endless ping-pong rally of emails — unless your team uses Doodle.

Now updated for Slack Connect, Doodle Bot makes it easy to propose time slots, see everyone’s availability, or send calendar invites, all within a shared Slack channel.

For example, your customer success team can schedule a check-in with key accounts and find time for everyone — no email chains required. And it’s likely that the same account team will introduce Doodle Bot to other strategic partners in Slack Connect, creating a network for adoption.

Making it easier for multiple orgs to share and preview files

Sharing files with external organizations can be a tedious task of toggling settings and individually granting permission to each partner. Now compatible with Slack Connect, Microsoft OneDrive allows all partners to search, share and preview OneDrive or SharePoint Online files right from a shared Slack channel.

Instead of individually granting each member of a PR agency permission to edit a press release, for example, users can share it in the channel with one click. Members of all teams collaborating in the channel can see OneDrive’s rich file previews in Slack, experiencing the app’s utility firsthand.

Extending internal workflows to external use cases

When support, sales and success teams share a channel with a customer through Slack Connect, they’re able to triage issues faster by looping in the right experts from both sides.

Halp, an Atlassian-owned ticketing system, turns Slack messages into tickets with a simple emoji reaction, and invoking Halp in Slack Connect gives customers visibility into the triage process, too. Let’s say a customer posts feedback in a shared Slack channel. Halp will turn that comment into a ticket, allowing customers to keep track of progress on their requests in a thread.

Prior to Slack Connect, a workflow like this was discoverable and usable only by internal teams that had Halp installed on their own workspace. With an update for Slack Connect, your app is both useful in more settings and for more organizations.

Extend the power of your Slack app with workflow steps

Workflow Builder is a visual tool that allows any Slack user to automate routine processes, and it’s proved handy in Slack Connect to onboard new teammates or triage requests with external vendors.

Coding a workflow step for your Slack app is now in open beta, making Workflow Builder another avenue for your app to shine in Slack Connect. Users can create workflows that, for example, send data to an external service, create tasks in project management trackers, or update the status of a ticket in an external ticketing system. By adding workflow step functionality to your new and existing apps, you’ll give multiple organizations the building blocks to deeply customize their work with your app.

Getting started

Feeling inspired? Get started by reading our API documentation on building for Slack Connect.

Questions? Email feedback@slack.com or tweet @SlackAPI.

Multiply your app’s reach with Slack Connect was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

You can now develop components of a Slack app that will soon be available as steps in Workflow Builder, enabling anyone to create custom workflows in Slack that integrate with their external tools.

Since launching Workflow Builder late last year, hundreds of thousands of builders have published workflows that are used millions of times monthly. 75% of these builders are non-technical, indicating a need for more tools that empower anyone to uniquely customize how they work in Slack.

The basics of Workflow Builder

Workflow Builder is a visual tool available to anyone using a paid Slack plan, so they can turn routine tasks into automated workflows right in Slack.

Without writing a single line of code, builders can create channel-specific workflows that automatically run through a sequence of steps when triggered. This comes in handy for things like onboarding new teammates, handling requests, team stand-ups, and more.

Workflow steps from apps

Now you can code a workflow step for your Slack app that builders can then choose when creating a custom workflow. Each app can have up to ten workflow steps.

Until today, builders could only select from native Slack steps, like sending a message or creating a form. With steps from apps, builders will be able to create workflows that, for example, send data to an external service, create tasks in project management trackers, or update the status of a ticket in an external ticketing system.

A new workflow step for Google Sheets will make it easy to push data from Slack right into a spreadsheet. This comes in handy for workflows that collect information through a form, so builders can configure their workflow to automatically send those form responses as a new row in the Google Sheet of their choice.

When launched to users later this year, steps from apps will be featured across a variety of Slack-owned locations, like an in-product step library, on the App Directory, Slack Tips and more.

An opportunity to extend your reach

By adding workflow step functionality to your new and existing apps, customers will have new ways to connect your service to their daily work in Slack. When deciding which steps to develop, it’s important to identify the most valuable actions people can take with your app.

Once available through Workflow Builder, anyone will be able to automate routine tasks that include custom interactions with your app — whether that’s receiving, or sending information to Slack from your service.

The team at Polly, a polling app for Slack, is building a workflow step for their app’s most popular use case — requesting feedback. This workflow step will be useful for teams that triage time-sensitive information, like customer support tickets. For example, they can build a workflow that is triggered by an emoji reaction, which then sends a pre-built customer satisfaction survey administered by Polly.

Deeper customization for enterprise-grade workflows

If you develop custom Slack apps that integrate with your company’s internal tools, you can also hook those business-critical integrations into Workflow Builder by simply adding workflow step functionality.

Perhaps your company uses an internal task management system, and you’ve already built a custom app that sends notifications to Slack with task updates. If someone wants to see more details or create a new task in the system, they have to leave Slack and log into that separate tool.

By making your app available as a workflow step, builders can create workflows that automate routine processes, like creating a new task, to keep work moving forward without leaving Slack.

Getting started

Now available in open beta, you can start coding your app’s steps today. Go to the Slack app configuration page, choose your app, select “workflow steps,” and toggle on the feature. Visit Slack API for documentation, tutorials, design guidelines, and more.

Need more hands-on support? Join next week’s webinar, Extending your app with Workflow Builder, to dive deeper with the Workflow Builder team — plus lots of time for Q&A.

Send us your feedback and questions by emailing feedback@slack.com.

Stickier Slack apps with workflow steps was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Learn how the latest Slack apps built shortcuts as a simpler, more intuitive way to drive user interactions in Slack.

Reposted from April 29, 2020

We recently introduced new ways to interact with apps — including shortcuts, simpler, more intuitive ways for users to take action with Slack apps. Starting today, anyone can use shortcuts from their favorite tools to get work done in Slack.

It’s increasingly valuable to make tools and information available at users’ fingertips. As more Slack users transitioned to remote work this past month, they’ve nearly tripled the rate at which they integrate tools — leaning on apps to reduce context-switching and inspire new, more productive habits.

Shortcuts give users visual, intuitive ways to take action with Slack apps. With a quick click of the lightning bolt button next to the message input, it’s easy to pull up the shortcuts menu and quickly create tasks, polls, and more — right from Slack.

Read on to learn how you can build shortcuts for your app.

Meet users where they’re already working

In our State of Work research, 68% of respondents told us that they’re spending at least 30 minutes a day switching between tools.

That’s why Freshdesk, a customer support platform, built a shortcut for creating a new support ticket — a key action that support agents complete dozens of times a day.

“Agents and team members don’t need to switch tabs and open Freshdesk — they can just view the full context of the ticket and work from inside the Slack interface, where they may already spend much of their time,” said Tejas Bhandarkar, Head of Product at Freshworks.

Increase engagement with your app

Shortcuts aren’t just about easy access — they’re designed to deepen engagement, making your app more intuitive and delightful to use.

Doodle Bot, a scheduling platform, previously used slash commands and ephemeral messages to facilitate the creation of polls — interactive surveys that teams use to vote on meeting times.

Using shortcuts and modals — windows that collect details or dynamically display information in Slack — Doodle Bot transformed poll creation, making it simpler and more seamless.

“Our completion rates for creating a poll increased 200% after implementing modals. We’re really excited about how our shortcuts experience will drive usage of Doodle Bot in Slack,” said Timoteo Canonica, Product Manager at Doodle.

While you may be tempted to increase app engagement by building multiple shortcuts, less is more. Shortcuts are designed to put a few key actions at users’ fingertips; whereas the home tab is spacious enough to highlight all aspects of your app’s functionality.

Create dynamic shortcut experiences

For apps packed with complex functionality, deciding on a specific shortcut experience can be challenging.

Apttus Max, a virtual assistant for revenue operations, built shortcuts for creating a quote or NDA. After kicking off a shortcut, Apttus Max dynamically updates a modal based on prior inputs, so users can search for an account, fill out details, and submit a request — all in one persistent experience.

With Xactly Incent, a sales performance platform, users can quickly submit commission inquiries right from Slack. Xactly shares a custom performance snapshot at the start of the shortcut experience, so relevant details are handy as users complete an inquiry.

Build a shortcut for your app today

Whether you’re new to building Slack apps or a seasoned pro, it’s simple to get started creating a shortcut for your app today.

We’re continuing to make ongoing improvements to shortcuts in the coming weeks. As you start building, feel free to share feedback directly in this survey. We can’t wait to see what you build!

Questions? You can always tweet @SlackAPI or email feedback@slack.com.

Skip the tab juggling — and take a shortcut was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Slack now offers a simpler, more organized experience for users — whether you’re a power user or just starting on Slack, working remotely or in an office. These improvements also make it easier for the 12 million people who use Slack everyday to discover, understand, and use apps.

The average paid user spends more than nine hours each workday connected to Slack, with nearly 90 minutes of active use. Apps built by our community of 700,000 developers drive a lot of that engagement — helping users unlock productivity by accessing key information and tools in Slack, where their team is already collaborating.

With the average enterprise using more than 1,000 cloud services, it’s invaluable to put everyday tools right at a user’s fingertips. Here’s how we’re making it simpler to do that, right from Slack:

• A shortcuts button for users to swiftly take action with a Slack app
• A dedicated place for users to discover and launch apps right from Slack
• A way to organize channels, direct messages — and apps — into sections in the sidebar

Introducing shortcuts

Shortcuts are simple, visual ways to take action with apps from anywhere in Slack. Users can quickly access shortcuts in a new lightning bolt icon next to the message input field.

For some users, slash commands are a secret superpower that can unlock immense productivity in Slack. However, only a fraction of users discover this magic. While slash commands continue to be a speedy way for experienced users to engage with apps, shortcuts make apps more discoverable and intuitive for anyone to use.

A more intuitive app experience

Apps with shortcuts are also more predictable, especially when coupled with modals — windows that allow an app to collect details from users or display dynamic information. For instance, Simple Poll, a polling app on Slack, uses multi-step modals to comfortably guide users through creating a poll.

“With shortcuts, we’re excited for Simple Poll to offer an omnipresent, straightforward, and fundamentally simple way to create polls in Slack,” said Simple Poll founder, Wilhelm Klopp.

“We expect shortcuts to substantially contribute to Simple Poll usage, especially from users who felt less comfortable with slash commands or didn’t even know Simple Poll existed.”

Improving app discovery

Apps will also have a more prominent place in Slack — so once your app’s installed, it’s easier to drive adoption across the workspace.

Slack’s refreshed interface introduces a customizable sidebar so users can access their preferred conversations and information — including a dedicated page for apps. This gives users a single destination to browse for apps already installed in the workspace, discover new apps, or open apps they recently used.

The experience is especially powerful for apps with a home tab — users are seamlessly brought into an interactive space to find information or take action.

With this new experience, users on paid plans will also be able to organize their channels, direct messages, and apps into personalized sections within the sidebar. For example, an app like Jira or Asana can be placed in a projects section, so it’s easier to stay on top of issues and tasks.

Getting started

Today starts our rollout of the new Slack experience on desktop, followed shortly by an updated experience on mobile. Shortcuts is now available in open beta—get started building a shortcut today by reading documentation on Slack API.

Shortcuts round out the Slack app toolkit — the happy path for building best-in-class apps in Slack. Coupled with granular permissions and a home tab, you’ll be well on your way to building secure, engaging apps that transform the way people work.

We can’t wait to see what you build!

The survey results cited are from a July 2019 survey that we conducted of approximately 1,700 U.S.-based users who had been using Slack for at least six months and used at least two of our most popular apps in the two weeks prior to the survey. Our top apps include apps developed by Slack, our partners, or other third-party developers.

Questions? Email feedback@slack.com or tweet @SlackAPI.

Introducing new ways to interact with apps was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Early last year, our Sales Analytics team approached us with an idea for a new custom bot. Our Sales reps were spending many hours each week creating customer slide decks. They were building these decks by copy/pasting content from our BI tool into Google Slides. The work was repetitive and error prone — a perfect candidate for automation.

It’s so rewarding to tackle a great idea, design and build something that helps others — project name: Midas Touch, an ode to Greek mythology, going from good to gold!

Our Midas Touch dream

At its core, we envisioned Midas Touch as an integration between Slack, Salesforce (Slack’s CRM), Looker (Slack’s BI Tool), and Google Slides. Midas Touch allows users to search for customers in Salesforce and request a set of pre-populated custom set of slides, pulled from a Looker dashboard — all without leaving Slack.

With the UX work sorted out, next up was the magic — and potentially thousands of hours saved for our Sales & Customer Success teams!

Getting started

Our team leveraged existing tools and Slack apps that accelerate our product development cycle. We leaned on that principle as we started exploring ways to make Midas Touch a reality.

The first step was to ensure our goals were possible. A brief review of the Looker API docs clarified that pulling the data from Looker wasn’t a problem, but we weren’t sure how to insert that data into specific locations within each custom slide deck.

After reviewing the Google Slides API docs, we found two request-types that looked promising: ReplaceAllText, which enables search and replace in a presentation; and ReplaceAllShapesWithSheetsChart, which substitutes a particular shape (like a text box) with a linked Google Sheets chart.

With Google API calls set, designing the rest of the app was pretty straightforward. We set up two template files: one Slides file and one Sheets file. The Slides file contained variables surrounded by brackets for easy search-and-replace functionality, and the charts had textbox placeholders with their own variable names.

Accompanying each Slides file is a Google Sheets file that stores the relevant dashboard data from Looker. Charts for the slides would be in this Sheets file and the placeholder data is then replaced with the selected company’s data. In addition, we included the variable mappings, indicating which field in the Sheets file corresponds to a particular variable in the slides.

Building a prototype

Now it was time to test our design. We started with a two-page slide deck with four scalar variables and one chart.

With a tight timeline, we needed the fastest way to build this app. Our team was already familiar with Workato from past projects. Workato has a good selection of pre-built integrations — like Workbot, which interfaces with Slack to post and receive messages, listen for slash commands and handle most Slack API interactions without excess complexity. It also offers a Salesforce integration, which simplified the account lookup portion of our plan.

Workato doesn’t integrate with Looker or Google Slides, but it’s extensible, so we simply created our own.

Scaling our proof of concept

The proof of concept only used two queries — but the desired final output has dozens of queries. Separate queries in Looker were no longer feasible and needed a code change to add new data. We needed an automated process.

Through the Looker API docs, we found a way to pull all Looker data in a single step. Although there wasn’t an endpoint specifically designed for this purpose, we did find scheduled_plan_run_once — enabling us to select a dashboard, request, and download data to a zip file that we then delivered to a webhook. Setting up a webhook in Workato is simple, so this solution was a perfect fit.

Using this endpoint brought up the next issue: Workato couldn’t deal with zip files. As the dashboard grew in size, the list of .CSVs was getting longer so the Google payload for reading mappings and writing requests was increasing in complexity.

Thanks to prior projects using Workato, we found a workaround. Using a Django-based multi-app hosted on Heroku and a custom Workato connector generator, we were able to spin up a sister app and run custom Python code there.

During our research phase, we wrote a short Python script using the Python client library for Google APIs. This 100-line script was able to decrypt the Looker payload, unzip the .CSVs, copy them to sheets, read the mappings, and construct the requests to send to the Slides API in a large batchUpdate. Because the client library handled this complex process, our work was done.

Adding this script to the existing Django installation, meant our Midas Touch microservice was ready to interact with Workato with some extensions to Django’s REST API.

Due to Heroku timeouts and the length of time it took to run the process (1–2 minutes), Midas Touch needed a background worker — so we chose Celery backed by Redis. This event-based architecture ensured that no matter how large the payload, a user wouldn’t need to wait. Instead, the user sees an “in process” message and the files are delivered to them asynchronously.

Final thoughts

This multi-system, hybrid approach enabled us to iterate on our prototype, while offloading processing to a robust Django application and leveraging the Google-built Python API library.

This is a custom app success story, because it brought together many systems, teams, and projects to deliver an impactful product. Instead of reinventing the wheel, we creatively built upon existing tools and processes, and provided this complex system in just a matter of months.

Midas Touch is emblematic of successful cross-functional development. This integration is not possible without application engineering, sales, data and analytics teams all working closely together.

We look forward to building more custom apps like this with our amazing colleagues here at Slack. Read more about Midas Touch and its impact at Slack.

Questions? Email feedback@slack.com or tweet @SlackAPI.

Midas Touch, a Slack app built by Slack was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Slack shines when users are empowered to get their work done quickly and easily — with app builders, like yourself, but making those delightful experiences possible.

Today, there are a few new ways to make those apps sing: the latest interactive app surface, the app home tab; and the newest addition to the Block Kit family of interactive elements, checkboxes.

Create a persistent place for app users

We recently introduced the Slack app toolkit — the happy path for building apps that anyone can easily discover, understand, and use in Slack. Block-Kit-enabled surfaces, or the places people can experience rich app interactivity in Slack, are a component of the toolkit.

The latest surface, app home, offers a consistent place for users to engage with your app and is easily discoverable through the Slack sidebar. This surface contains three tabs — the about tab, messages tab, and home tab.

While the messages tab alerts users in real-time, you can now go beyond conversation-based interactions with the home tab — a fully customizable, interactive surface to showcase what your app can do.

The home tab is the default place for people to learn how to use your app without leaving Slack. Home can be used for settings, onboarding, dashboards, or custom content — specific to each user and each app.

Zapier, an automation tool, is launching a home tab for their Slack app that displays each person’s existing workflows (also known as Zaps). For novice users, there’s a whole section for learning how to use the app, like Make a new Zap and Some more things to try.

Build user-specific app experiences

The home tab isn’t simply a place for generic text. This surface enables you to display dynamic content for each user — like upcoming tasks, calendars, pending requests, or recent survey results.

Halp, a ticketing platform for operations teams, updated their existing Slack app with new functionality that enables Slack users to filter, edit, and respond to tickets in the home tab. This dynamic dashboard reduces context switching and displays the most critical information all in one place

Design for each surface

Block Kit, the Slack app UI framework, continues to power more surfaces in Slack — most recently, the home tab, modals and messages. This opens up a world of possibilities for how app experiences can flow seamlessly in Slack.

Donut, a team-building app for Slack, built a home tab to help people manage app settings. While the app pairs and introduces teammates, the home tab is the default place for users to better understand how to use the app.

For instance, Donut’s home tab welcomes users and introduces fundamental things they can do with the app including an FAQ button. Clicking this button opens a modal of helpful content about the basics of using Donut in Slack.

There is a unique use case for each surface and how these surfaces interplay to create deep productivity for app users. Learn more about the suggested best practices for building on each surface here.

But wait, there’s more!

Block Kit now supports a new interactive element — checkboxes. This UI component is best used for settings, tasks, and making quick contextual selections in a modal or home tab.

Support for checkboxes is already available, so you can update your app and incorporate them right away. Start prototyping today in the Block Kit Builder.

Build a home for your app today

Whether you’re new to building Slack apps or a seasoned pro, get started creating a home tab for your app today by reading documentation on Slack API.

Also sign up to compete in the upcoming online hackathon on March 2–9, 2020. Show off what your app can do, connect with other builders, and get hands-on support from Slack’s product and engineering teams.

Questions? Email feedback@slack.com or tweet @SlackAPI.

There’s no place like home was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Apps make work more pleasant and productive for teams in Slack. To make that happen, apps request permission to access information in a workspace.

Slack admins use app approvals to maintain control over the apps installed on their workspaces and to protect company data from security threats. Before installing an app, admins review what permissions an app is requesting, as well as its policies for security and data retention — but obtaining and reviewing this information can add time and friction to the app approval process.

Starting today, we’re kicking off the process of collecting security and compliance details for apps published in the App Directory. When submitting your app for review, you’ll find a section called Security & Compliance where you can start filling out information.

About security & compliance information

As a developer on Slack, surfacing security & compliance information in the App Directory allows you to answer critical questions for Slack admins, helping them make faster, more informed decisions about your app.

Here are the four categories of information you can provide — plus a peek at the new Security & Compliance tab in your app listing:

General

Admins want to know who built your app. In some cases, an app developer won’t be the same as the parent software company — at Slack, we built the Google Calendar app in-house.

By sharing your official developer name, where your company is located, and a link to your terms of service, you can establish an identity for your app.

Privacy & data governance

The data that flows through your app falls under to the Slack Developer Policy and API Terms of Service. With the security & compliance section, you can get more specific on how your app manages data, including details about retention, archive, storage and removal practices.

Articulating your approach to data governance can give admins confidence that your service has strong data management practices in place to identify, locate, and retrieve information as needed, in a timely and reliable manner.

Certifications & compliance

There are general audits and certifications that any service can acquire to verify that they operate under a specified set of security standards, like ISO 27001 or SOC 2. Depending on the industry, there might also be more nuanced standards, like HIPAA compliance or FedRAMP compliance.

By making links to your app’s certifications & compliance easily accessible in one place, Slack admins can spend less time searching for information and more time learning about your app.

Security

Certifications and audits take time, but, chances are, you already have a few of the building blocks that make up a strong security program. For example if your service supports security features like SAML authentication and SSO, that’s a simple way to let admins know there’s a level of security in place to authenticate users.

There are also ways to pressure test your app against real-world scenarios — like penetration tests, which simulate a cyber attack to identify any security vulnerabilities.

To supplement pen testing schedules, some services will establish more scaled, community-based programs to report potential vulnerabilities whenever they arise:

• Vulnerability disclosure programs rely on the good will of the developers to crowdsource potential security vulnerabilities
• Bug bounty programs incentivize developers to report any vulnerabilities in exchange for compensation

Opting to be transparent with Slack admins builds credibility. Even if some security and compliance details are not applicable for your app, each piece of the puzzle you provide can help admins make better decisions about your app.

Getting started

You can start submitting security and compliance details today, as part of the open beta. Under your app’s Settings, you’ll find a new section called Security & Compliance where you can start filling out information. We’ll review your submission, but it’s up to the developer to ensure the accuracy of these details.

Starting July 31, 2020, the App Directory will require newly submitted apps to provide certain security & compliance details. Existing Slack apps on the App Directory will be required to input this information by December 4, 2020.

Questions or feedback? Email feedback@slack.com or tweet @SlackAPI.

Looking for more information on certifications? We’ve compiled a few links:

• SOC certification
• ISO/IEC-27001 certification
• ISO/IEC-27017 certification
• ISO/IEC-27018 certification
• FedRAMP certification
• CSA Star level certification
• HIPAA compliance
• Privacy Shield Notice
• GDPR

Building trust with security-conscious customers was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

We recently introduced the Slack app toolkit — the happy path for building apps that anyone can easily discover, understand, and use in Slack.

Permissions, or the way apps request information in Slack, are the first component of the toolkit. We’ve redesigned the bot token with a revised permissions model called granular permissions. Now you can request only the information needed for your app to function and drive deeper adoption among security-conscious customers.

This year, we will require granular permissions for Slack apps listed in the App Directory. To learn more, read on.

Reducing scopes

As a general security practice, many admins operate under the principle of least privilege, which restricts a user’s access to the minimum permissions needed to perform their work. So, before users can try out your app in their Slack workspace, they must first get approved by security-conscious admins. With a redesigned OAuth page, admins can now see exactly what your app can view and do in their workspace.

Before granular permissions, apps using the bot token received a broad set of scopes; developers did not have a way to pick and choose the information their app actually accessed. Now, with granular permissions, you can specify the exact scopes needed for your app to function.

Imagine a Slack app for reporting and approving expenses. Before granular permissions, this app would have been issued a blanket set of scopes. In that world, below is what an admin would see when reviewing the app. You’ll notice this app requests access to information it probably doesn’t need — like `channels:history`, the ability to fetch the history of messages in a channel. As a result, an admin may be less likely to approve it.

Consider the same Slack app using granular permissions. A developer could select only what their app needs and exclude unneeded scopes, like `channels:history`, to get the benefit of a less-permissive app. You’ll notice the page is simpler to review — and less intimidating for the admin.

Building for the enterprise

PLAID, a Tokyo-based analytics company, launched a new Slack app for their customer experience platform, KARTE — a service that delivers real-time data and analytics reports to users.

The KARTE team’s priority was to drive adoption of their service, particularly among security-conscious customers. Using granular permissions enabled KARTE to request the minimum number of scopes and increase their likelihood of adoption within the enterprise.

Improving app reliability

Granular permissions also offer more reliability for you and your app’s users. Apps using this model will continue to work, even when the original installer leaves a workspace.

For instance, Donut, a team-building app for Slack, gets installed once by a single person — but hundreds or thousands of people might use it within Slack to connect with their teammates.

Donut was initially built with a user token. Due to the limitations of that token type, when an app installer left their company, the Donut app automatically uninstalled. Now with granular permissions, the app will remain on a workspace without interruption.

Adding incremental scopes

Granular permissions give you more flexibility to add incremental functionality to your app — without the hassle of managing several tokens. That’s because we’ve wrapped all app functionality into one, streamlined bot token.

Simple Poll, a polling app for Slack, previously elected to build on the user token. While the token was less permissive, it also meant that Simple Poll missed out on some of the functionality offered by the bot token. By migrating to granular permissions, Simple Poll can make updates to their app or request new scopes as needed.

“An added benefit is that we’re aligning Simple Poll to the favored permissions model that will unlock future capabilities,” said Simple Poll founder, Wilhelm Klopp. “We want to be on the model that Slack is recommending and investing in.”

Getting started

We recommend all apps build on this foundation to take advantage of future Platform features. Get started by reading permissions documentation.

Starting February 21, 2020, the App Directory will require newly submitted apps to use granular permissions. Existing Slack apps on the App Directory must update by the end of 2020. Refer to the migration guide to learn how to upgrade your app.

Thanks to your feedback, we are making ongoing improvements to granular permissions in the coming weeks. Continue to share with us by emailing feedback@slack.com.

Looking for hands-on support? Save your spot for the Slack app virtual hackathon today.

More precision, fewer restrictions was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

TL;DR

On March 4, 2020, Slack will end support for Transport Layer Security (TLS) versions 1.0 and 1.1. In advance of this, we will implement a 24-hour test deprecation on February 19, 2020.

If your Slack app or organization is using an unsupported version of TLS, requests sent to any Slack service will fail. We are making this change to align with industry best practices for security and data integrity.

What is TLS?

TLS enables a secure connection between two web-based applications that share information — like your IT systems and Slack. This is the most widely deployed security protocol and is common for most modern applications, including web apps like Salesforce.

There are multiple versions of TLS, including 1.0, 1.1, 1.2, and 1.3. You should discontinue use of versions 1.0 and 1.1.

Next steps for admins

Ensure your organization can continue using Slack without interruption. Verify your team is using the latest version of Slack on desktop and mobile, or in a supported browser version.

To view a list of affected users and applications in your workspace, follow the instructions documented in our Help Center article, Transport Layer Security (TLS) in Slack.

Next steps for developers

Confirm all app(s) you’ve built for Slack are using TLS versions 1.2 or higher. Requests sent to any Slack endpoint will fail. This includes apps using the Slack API, incoming webhooks, and custom integrations.

View your affected Slack app(s) here, and upgrade any that are not already using TLS 1.2 or higher. This may be a matter of updating your code with a newer version of Python, PHP, or other languages.

If your app is built with modern programming languages, HTTP libraries, and frameworks, changes are unlikely. Also, if your organization uses 3rd-party Slack apps, confirm installation of the latest versions.

Need more answers? Contact our support team through feedback@slack.com.

Ending support for TLS 1.0 and 1.1 was originally published in Slack Platform Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.