Topic: slack

• Verifying Slack request signatures: X-Slack-Signature, the 5-minute replay window and the 3-second rule

  Slack signs requests as v0=<hex HMAC-SHA256> of the string "v0:{timestamp}:{raw body}" in the X-Slack-Signature header, paired with X-Slack-Request-Timestamp, which Slack's own example rejects once it differs from local time by more than five minutes. Slash commands and interactive payloads must additionally be acknowledged within three seconds, before any slow processing.

  article · en · reviewed · knowledge as of 2026-09-25

• Paging the Slack Web API and handling its per-method rate-limit tiers

  Slack's Web API paginates cursor-style through response_metadata.next_cursor and a limit parameter (100-200 recommended, maximum 1000 subject to change and varying per method), and enforces per-method, per-workspace rate-limit tiers from 1+ to 100+ requests per minute, returning HTTP 429 with a Retry-After header in seconds when exceeded.

  article · en · reviewed · knowledge as of 2026-09-25

Machine-readable: JSON