Why does slack-mcp-server with XOXC/XOXD tokens fail with invalid_auth while caching users?

6 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Status: still open — no fix for the token invalidation is confirmed in this thread. The maintainer confirmed that Slack's warning is just a warning and it merely invalidates the xoxc/xoxd token. The reporter's claim that XOXP tokens are not affected is not disputed anywhere in the thread.

  The failure appears right after the server logs "Caching users collection..." and exits with error "invalid_auth" from RefreshUsers (pkg/provider/api.go:431). The maintainer asked for debug logs using SLACK_MCP_LOG_LEVEL=debug and SLACK_MCP_CUSTOM_TLS=1; values 1 and true enable custom TLS, and the maintainer confirmed that a quoted "1" in the JSON env block is fine. One commenter tried "true", "1.3", and a certificate value with no success.

  A commenter using Claude on macOS shared this config:

  jsonCopy to clipboard

  {
    "mcpServers": {
      "slackkk": {
        "command": "npx",
        "args": ["-y", "slack-mcp-server@latest", "--transport", "stdio"],
        "env": {
          "SLACK_MCP_XOXC_TOKEN": "xoxc-...",
          "SLACK_MCP_XOXD_TOKEN": "xoxd-...",
          "SLACK_MCP_LOG_LEVEL": "debug",
          "SLACK_MCP_CUSTOM_TLS": "1",
          "SLACK_MCP_USER_AGENT": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"
        }
      }
    },
    "isUsingBuiltInNodeForMcp": false
  }
  

  With that setup the server logged "Custom TLS handshake enabled" and "TLS Fingerprinting Details", but no working fix was reported. The maintainer said isUsingBuiltInNodeForMcp must stay false and, when using Claude, to make sure the host's node is used. If you call tools before the user cache finishes syncing, you get a "Slack users sync not ready" warning; the maintainer said that leaves you at roughly 30% of MCP functionality. General advice: XOXC/XOXD are browser session tokens, so treat them as credentials and avoid committing them to shared config files.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Reporter ran slack-mcp-server over STDIO with XOXC/XOXD tokens; the server logged "Caching users collection..." then failed with invalid_auth and exited fatally. The reporter also stated that XOXP tokens do not trigger this invalidation.

  Source: https://github.com/korotovsky/slack-mcp-server/issues/86 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @clemenquine tried on GitHub (Outcome unclear)

  Commenter enabled debug logging and custom TLS with SLACK_MCP_LOG_LEVEL=debug and SLACK_MCP_CUSTOM_TLS=1 plus a desktop Chrome User-Agent; logs showed "Custom TLS handshake enabled" and TLS fingerprinting details, but no fix for the token invalidation was reported.

  Source: https://github.com/korotovsky/slack-mcp-server/issues/86#issuecomment-3215380860 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @clemenquine tried on GitHub (Didn't work)

  Commenter tried SLACK_MCP_CUSTOM_TLS set to "true", "1.3", and a certificate value; none of those values worked.

  Source: https://github.com/korotovsky/slack-mcp-server/issues/86#issuecomment-3209547730 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @clemenquine tried on GitHub (Didn't work)

  Commenter set isUsingBuiltInNodeForMcp to true in the Claude config and saw no difference. The maintainer said it must stay false.

  Source: https://github.com/korotovsky/slack-mcp-server/issues/86#issuecomment-3218199818 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @clemenquine tried on GitHub (Outcome unclear)

  Commenter confirmed their SLACK_MCP_USER_AGENT value matched the User-Agent of the browser the token came from, using whatismybrowser.com.

  Source: https://github.com/korotovsky/slack-mcp-server/issues/86#issuecomment-3218221403 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport