Slack OpenID Connect

Slack login is optional and controlled by SLACK_AUTH_ENABLED. When disabled, Slack endpoints return 503 Service Unavailable. JWTs are never placed in the redirect URL; the API issues a one-time exchangeCode (Redis, 60 seconds). The same POST /auth/exchange endpoint is shared with other social providers.

• • Feature-flagged via environment
• • Custom passport-oauth2 strategy + SlackAuthGuard (not legacy passport-slack / identity.*)
• • Profile fetched via GET https://slack.com/api/openid.connect.userInfo after token exchange
• • Redirect allowlist prevents open redirects
• • Same token response shape as POST /auth/login

Create an app at https://api.slack.com/apps → Create App. Under OAuth & Permissions, add a Redirect URL matching SLACK_CALLBACK_URL. Under User Token Scopes, add openid, email, and profile.

1. Open https://api.slack.com/apps and click Create App
2. Under OAuth & Permissions, add a Redirect URL (e.g. http://localhost:3000/api/v1/auth/slack/callback)
3. Under User Token Scopes, add openid, email, and profile
4. Install the app to your workspace if prompted
5. Copy Client ID and Client Secret into your .env
6. Ensure SLACK_CALLBACK_URL matches the Redirect URL registered in Slack

Loaded from .env via src/config/slack-oauth.config.ts (namespace slackOAuth on ConfigService). See .env.example.

SLACK_AUTH_ENABLED=true
SLACK_CLIENT_ID=your-slack-client-id
SLACK_CLIENT_SECRET=your-slack-client-secret
SLACK_CALLBACK_URL=http://localhost:3000/api/v1/auth/slack/callback
SLACK_REDIRECT_ALLOWLIST=myapp://success,http://localhost:5173/auth/callback
SLACK_OAUTH_DEFAULT_ROLES=

New Slack users receive roles: [] by default (same as password register). Set SLACK_OAUTH_DEFAULT_ROLES in .env to a comma-separated list of Role values (e.g. user or user,manager). Existing users linked by email keep their current roles.

1. Client opens GET /api/v1/auth/slack?redirect=<allowlisted URL>
2. User consents on Slack; browser hits GET /api/v1/auth/slack/callback
3. API calls GET https://slack.com/api/openid.connect.userInfo, upserts user, stores exchangeCode in Redis, redirects to redirect?code=...
4. Client POSTs { code } to /api/v1/auth/exchange and receives JWTs

Typical flow: button starts OAuth in the same window (or popup); a callback route on your frontend origin reads code from the query string and calls exchange.

const API = 'http://localhost:3000/api/v1';
const redirect = encodeURIComponent(
  'http://localhost:5173/auth/callback'
);

// Full-page redirect to Nest → Slack → back to SPA
window.location.href = `${API}/auth/slack?redirect=${redirect}`;

// /auth/callback on the SPA
const params = new URLSearchParams(window.location.search);
const code = params.get('code');
if (!code) throw new Error('Missing exchange code');

const res = await fetch('http://localhost:3000/api/v1/auth/exchange', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ code }),
});
if (!res.ok) throw new Error(await res.text());

const { user, accessToken, refreshToken } = await res.json();
// persist tokens as your app requires
sessionStorage.setItem('accessToken', accessToken);
console.log('signed in', user.email);

• • Add your frontend callback URL to SLACK_REDIRECT_ALLOWLIST (e.g. http://localhost:5173/auth/callback)
• • SLACK_CALLBACK_URL must point at the Nest API, not the SPA
• • Store accessToken / refreshToken securely (memory + httpOnly cookie patterns as you prefer)

Use a custom scheme (or universal link) in the allowlist. After Slack, the API redirects to myapp://success?code=.... The app opens, parses the code, and calls exchange.

import * as Linking from 'expo-linking';
import * as WebBrowser from 'expo-web-browser';

const API = 'https://api.example.com/api/v1';
const redirect = encodeURIComponent('myapp://success');

async function signInWithSlack() {
  const url = `${API}/auth/slack?redirect=${redirect}`;
  await WebBrowser.openAuthSessionAsync(url, 'myapp://success');
}

import * as Linking from 'expo-linking';

async function exchangeFromUrl(url) {
  const { queryParams } = Linking.parse(url);
  const code = queryParams?.code;
  if (!code) return;

  const res = await fetch(`${API}/auth/exchange`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ code }),
  });
  const data = await res.json();
  // data.accessToken, data.refreshToken, data.user
  return data;
}

Linking.addEventListener('url', ({ url }) => {
  exchangeFromUrl(url);
});

• • Register the scheme in the OS / Expo app.json
• • Prefer Linking.addEventListener('url', ...) and getInitialURL()
• • Exchange over HTTPS against your API base URL

• • Redirect URLs must match SLACK_REDIRECT_ALLOWLIST prefixes
• • Exchange codes are single-use and expire in 60 seconds (Redis)
• • Existing local users are linked by verified Slack email (slackId set; roles unchanged)
• • Slack-only users have password null — password login / change-password will fail until a password is set
• • Email is required from openid.connect.userInfo; login fails if Slack does not return an email (scopes openid email profile)

Postgres entity / interface fields used by Slack login:

• • slackId — unique nullable Slack OIDC subject (sub from userInfo)
• • password — nullable for OAuth-only accounts
• • isActive — set true for new Slack users
• • roles — from SLACK_OAUTH_DEFAULT_ROLES env (default [])

• Social Authentication hub
• Google OAuth2 guide
• Facebook OAuth2 guide
• X / Twitter OAuth2 guide
• GitHub OAuth2 guide
• Figma OAuth2 guide
• LinkedIn OpenID Connect guide
• Atlassian OAuth 2.0 (3LO) guide
• GitLab OAuth2 guide
• Bitbucket OAuth2 guide
• Discord OAuth2 guide
• Twitch OAuth2 guide
• Steam OpenID 2.0 guide
• Reddit OAuth2 guide
• Auth & JWT