slack2

Slack app lifecycle and workspace administration CLI. Create and manage Slack apps, inspect workspace settings, configure profile fields, update API-managed member profiles, and read access or audit logs from the terminal.

slack2 list                                   # apps you can manage
slack2 import A0123456789                      # pull an app's credentials into local config
slack2 webhook get A0123456789 --channel ops  # print a channel's incoming webhook URL
slack2 admin workspace show -w example         # inspect workspace identity and plan
slack2 admin member list -w example            # list workspace members
slack2 admin access-log list -w example        # redacted workspace access log

Install

# Homebrew (recommended)
brew install circlesac/tap/slack2

# npm
npm install -g @circlesac/slack2-cli

Authentication

slack2 uses your Slack browser session for app-management pages and workspace administration surfaces that Slack does not expose through a stable public API.

slack2 login                         # reads the first Slack browser session
slack2 login --workspace example     # selects a browser or desktop-app session for one workspace

The session is saved under the XDG state directory (normally ~/.local/state/slack2/cookies.json). Re-run slack2 login if a command reports that the session expired. Imported app metadata is stored under the XDG cache directory (normally ~/.cache/slack2/apps.json).

Manifest lifecycle commands also use the official Slack CLI credentials in ~/.slack/credentials.json.

Commands

Command	Args / options	What it does
login	-w/--workspace	Save a matching Slack browser or desktop-app session
create	<manifest>	Create an app via the Manifest API
install	<APP-ID>	Install a created app to the workspace (OAuth) → bot token
list	—	List Slack apps from api.slack.com
update	<APP-ID>	Update an app's manifest
delete	<APP-ID>	Delete an app via the Manifest API
token	<APP-ID>	Print the bot token for an app
import	<APP-ID> -w/--workspace -f/--force	Import an externally-created app into local config (scrapes client/signing secret)
webhook list	<APP-ID> --json	List the app's incoming webhooks (channel + URL)
webhook get	<APP-ID> --channel <name>	Print one channel's incoming webhook URL (scriptable)
webhook add	<APP-ID>	Mint a new incoming webhook via OAuth (pick the channel on the consent screen)
admin whoami	-w/--workspace --json	Show the signed-in member's workspace role
admin workspace show/update	-w/--workspace name, locale, or DND options	Inspect identity/plan and manage workspace-wide defaults
admin member list/get	-w/--workspace filters	Inspect workspace membership
admin channel list/get	-w/--workspace filters	Inspect channels visible to the signed-in admin
admin emoji list	-w/--workspace --aliases	List custom emoji and aliases
admin invitation list/show/update	-w/--workspace type/domain options	Inspect invitation history and manage approved-domain joining
admin profile-field list/get	-w/--workspace --json	Inspect field source, visibility, and allowed writers
admin profile-field update	<field> --source member|api|scim --visible|--hidden	Change one field with a diff, confirmation, and --dry-run
admin member-profile get	<member> -w/--workspace	Read one member profile
admin member-profile update	<member> --title --field <id>=<value>	Update API-managed values with confirmation and --dry-run
admin profile-policy show/update	-w/--workspace display/editor options	Manage profile display and schema-editor policies
admin channel-policy show/update	-w/--workspace message options	Manage message editing, join/leave, and mention-warning policies
admin retention show/update	-w/--workspace scope/mode/days	Manage message, file, canvas, and list retention
admin auth show	-w/--workspace	Show a whitelisted authentication summary
admin billing show/history	-w/--workspace	Show plan, renewal, seat count, cost, and redacted billing events
admin audit-log list	-w/--workspace filters	Read Enterprise Audit Logs API events
admin access-log list	-w/--workspace filters	Read paid-workspace access logs

App IDs look like A0123456789 — find them with slack2 list.

Official Slack CLI boundary

slack2 does not manage app display profiles or icons. Use the official Slack CLI and app manifest for display_information (name, description, long_description, and background_color) and app icons.

The browser session used by slack2 login is reserved for operations that the public Slack APIs and official CLI do not expose: discovering all apps, importing existing app secrets, looking up incoming webhook URLs, reading workspace-admin state, and publishing profile field configuration.

Workspace administration

Every admin command requires an explicit workspace domain:

# Verify the session and role
slack2 admin whoami --workspace example

# Actual workspace resources
slack2 admin workspace show --workspace example
slack2 admin member list --workspace example --role owner
slack2 admin channel list --workspace example --type public
slack2 admin emoji list --workspace example --aliases
slack2 admin invitation list --workspace example --type pending

# Workspace policy changes
slack2 admin profile-policy update \
  --workspace example \
  --display-phone enabled \
  --dry-run
slack2 admin channel-policy update \
  --workspace example \
  --message-edit-window 60 \
  --dry-run
slack2 admin invitation update \
  --workspace example \
  --domain-join enabled \
  --domains example.com \
  --dry-run
slack2 admin retention update \
  --workspace example \
  --scope public \
  --mode delete-after \
  --days 365 \
  --dry-run

# Profile field schema
slack2 admin profile-field list --workspace example
slack2 admin profile-field get Title --workspace example --json
slack2 admin profile-field update Title \
  --workspace example \
  --source api \
  --dry-run

# Member profile values (only API-managed fields can be written)
slack2 admin member-profile get U0123456789 --workspace example
slack2 admin member-profile update U0123456789 \
  --workspace example \
  --title "Engineering" \
  --field "Alternate Phone=+1 555 0100" \
  --dry-run

Field names must match exactly. IDs are safer for automation. Ambiguous member or field names are rejected rather than resolved to the first match.

Mutating commands always print a before/after diff. They require interactive confirmation unless --yes is supplied, and support --dry-run without sending the write request.

Profile data sources

• member: the member can edit the value in Slack.
• api: owners/admins with an eligible user token can update it through users.profile.set; members cannot edit it directly.
• scim: the mapped identity provider/SCIM integration owns the value.

Slack's admin profile editor publishes the entire profile schema at once. slack2 reads the latest schema, modifies exactly one resolved field, displays the diff, and then publishes the complete schema only after confirmation.

Available sources are resolved from each field's live workspace schema. Do not assume that two workspaces expose the same choices: for example, a Pro workspace may offer only member and api, while an eligible Business+ workspace can additionally expose scim. Unsupported choices fail before any write request is sent.

Workspace policy changes use the same browser-backed Slack admin forms as the web admin UI. --dry-run also checks that the relevant form exists for the current owner, plan, and organization context. A setting available on Business+ may therefore fail cleanly on Pro instead of being treated as a false/default value.

Retention writes are intentionally explicit: update one scope at a time, and provide --days for a delete-after mode. The confirmation warns when a policy can permanently remove messages or retained content.

Audit logs and access logs

These are separate data sets and commands:

• admin audit-log list uses Slack's Audit Logs API. It requires an Enterprise organization, an org-owner xoxp user token, and auditlogs:read. Select a locally installed app with --app-id, or set SLACK2_AUDIT_TOKEN.
• admin access-log list uses team.accessLogs and is available on eligible paid workspaces to owners/admins.

Network identifiers (ip, ip_address, isp, and user_agent) are redacted by default, including in JSON. Pass --include-network only when those values are needed for an authorized investigation.

Incoming webhooks

Slack incoming webhooks belong to a specific app + channel, and their URLs aren't exposed by the Slack Web API — normally you have to dig them out of the app's config page. webhook list/get read them from that page using your saved session; webhook add runs the OAuth install flow to create a new one.

# See every webhook configured on an app
slack2 webhook list A0123456789

# Grab one channel's URL (e.g. to feed an alerting integration)
HOOK=$(slack2 webhook get A0123456789 --channel alerts)

# Create a new webhook — choose the target channel in the browser
slack2 webhook add A0123456789

Notes

• App lifecycle commands operate per app (<APP-ID>); admin commands operate per explicit workspace (--workspace).
• Saved sessions, app credentials, and webhook URLs are secrets. Treat the slack2 XDG state/cache files accordingly and never commit captured values.

Release

Releases run through GitHub Actions (CalVer via @circlesac/oneup) — multi-platform binaries, npm publish, and a Homebrew tap update. Do not bump versions or publish by hand. See CLAUDE.md.