slack-user-token

• Provider documentation xoxp- user token, dash-separated sections, secret last · observed 2026-09-24 · the provider states user tokens begin with xoxp-, that tokens are dash-separated sections with the secret last, and shows a three-numeric-section example; it states no section widths or secret alphabet, says pre-August-2016 user tokens may carry 6- or 10-character secrets, and the 2016 token-lengthening changelog warns against relying on perceived token semantics
• gitleaks 8.30.1
• trufflehog 3.97.4
• Reference 1
• Reference 2

Lexical separability decided before authoring (#212): the provider-documented xoxp- prefix and the provider example's three dash-separated numeric sections followed by a secret section separate a user token from the recorded confusables (public T/U/B ids, masked sections, references, placeholders). The pattern deliberately freezes no numeric width and no secret alphabet or width: those are tool claims (gitleaks slack-user-token 10-13 digits and 28-34 [a-zA-Z0-9-]; noseyparker exactly 12 digits and 32 lowercase hex; trufflehog two sections and an open tail) and Slack says tokens may reach 255 characters. Twins therefore mutate only provider-documented properties (the xox stem and the p letter, the dash separator, the secret section itself). Kept separate and not claimed: rotating xoxe.xoxp- user/config tokens (scope undecided), the Slack CLI service-token xoxp-1-... shape, and the xoxc- browser session token. All three are real secrets and none is a control. The registry's detector-coverage slack-token shape-2 fixtures already carry xoxp- positives built to the product's frozen grammar; they target slack-token and are not this family's evidence.