Bot token

What it looks like

Descriptive pattern

^xoxb-[0-9]{12}-[0-9]{12}-[A-Za-z0-9]{24}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

• Provider documented · provider-source · current · observed 2026-10-04

  xoxb- bot token prefix; the page states that Slack tokens are dash-separated sections with the secret last (shown for an xoxp- user token) and states no section widths, secret width or alphabet for xoxb-

  • docs.slack.dev/authentication/tokensprovider-documentation · last read 2026-10-04 · latest outcome read · supports Bot token strings begin with xoxb-; tokens are divided into sections separated by a dash and the final section is the secret (stated in the user-token secret-rotation section, example xoxp-111-222-333-...)

• Tool corroborated · tool-corroboration · current · observed 2026-09-17

  Pinned scanner rules are consistent with the contract grammar (2 artifacts: gitleaks 8.30.1; trufflehog 3.97.4).

  • gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: gitleaks.toml
  • trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/slack/slack.goscanner-rule-source · last read 2026-09-24 · latest outcome read · supports trufflehog 3.97.4: slack/slack

• Unresolved · field-numeric-section-widths-and-secret · current · observed 2026-10-04

  numeric section widths and secret width or alphabet: no Slack page read states them for xoxb-; the only provider-stated widths are for user tokens (32-character secret in the page's example; pre-August-2016 user-token secrets of 6 or 10 characters), and the only xoxb- strings shown are elided (xoxb-1234-...). The 12/12/24 grammar rests on scanner rules only.

  • docs.slack.dev/authentication/tokensprovider-documentation · last read 2026-10-04 · latest outcome read · supports No xoxb- widths stated; user-token secret widths 6, 10 and 32 characters stated for xoxp- examples
  • docs.slack.dev/authentication/using-token-rotation/provider-documentation · last read 2026-10-04 · latest outcome read · supports Example request token=xoxb-1234-... is elided and gives no widths

• Provider documented · field-rotating-xoxe-xoxb-access-token · current · observed 2026-10-04

  rotating bot access token: oauth.v2.exchange on a granular bot token returns an access token that the page says has a new xoxe. prefix, shown as xoxe.xoxb-1-... (elided), with a refresh token shown as xoxe-1-...; the access token expires after 43,200 seconds and the original long-lived access token expires after the first refresh. The page states no widths, no meaning of the digit after the prefix and no alphabet for these forms. Outside descriptivePattern until scope is decided; never a benign control.

  • docs.slack.dev/authentication/using-token-rotation/provider-documentation · last read 2026-10-04 · latest outcome read · supports oauth.v2.exchange sample response: access_token xoxe.xoxb-1-... (elided), refresh_token xoxe-1-..., expires_in 43200, token_type bot; access_token now has a new xoxe. prefix

• Unresolved · field-rotating-form-version-digit · current · observed 2026-10-04

  digit after xoxe.xoxb-: the page shows 1 in an elided example; no source read states the range or meaning of this digit

  • docs.slack.dev/authentication/using-token-rotation/provider-documentation · last read 2026-10-04 · latest outcome read · supports Examples show xoxe.xoxb-1-... and xoxe-1-... only

• Provider documented · field-workflow-token-prefix-distinct · current · observed 2026-10-04

  workflow tokens are described as a subset of bot tokens but begin xwfp-, and the page contrasts them with xoxb- tokens; the page states no relation between the two secret formats

  • docs.slack.dev/authentication/tokensprovider-documentation · last read 2026-10-04 · latest outcome read · supports Workflow token strings begin with xwfp-; unlike xoxb- tokens, workflow tokens can sometimes access private channels

• Unresolved · field-legacy-bot-token · current · observed 2026-10-04

  legacy bot tokens: the page says they were obtained through an older OAuth flow and are discouraged, and states no prefix or format for them

  • docs.slack.dev/authentication/tokensprovider-documentation · last read 2026-10-04 · latest outcome read · supports Legacy token types section, Legacy bot tokens: no prefix stated

• Unresolved · field-token-like-public-identifiers · current · observed 2026-10-04

  identifiers shown beside bot tokens in OAuth responses (team id T123456, bot_user_id U123456, app_id A123456, client_id 60503450.61416): shown only as placeholders; no source read states their widths or that they are non-secret, and the relation of the xoxb- numeric sections to team or bot ids is not stated

  • docs.slack.dev/authentication/using-token-rotation/provider-documentation · last read 2026-10-04 · latest outcome read · supports oauth.v2.exchange and oauth.v2.access sample requests and responses

• Provider documented · dossier-research · current · observed 2026-09-17

  Legacy dossier research (verdict ready, tier T1) cited 2 sources; the dossier does not attribute sources to individual properties.

  • docs.slack.dev/authentication/tokensprovider-documentation · last read 2026-10-04 · latest outcome read · supports Cited by the legacy dossier research for this family
  • redact-secret/redact-secret @ 54c9ab35cb693e0cd3aedc8f858ca19ab77e4363: docs/decisions/2026-09-17-freeze-slack-bot-token-segment-grammar.mdproject-research-note · last read 2026-09-17 · latest outcome read · supports Final research evidence recorded by the legacy dossier

Open questions

No open question is recorded for this revision.