n8n Slack Node Permission Denied Error

Step by Step Guide to solve n8n Slack Node Permission Denied Error

 

 

---

 

Who this is for: n8n users who run Slack‑based workflows in production and need a reliable, repeatable fix for “Permission denied” errors. We cover this in detail in the n8n Node Specific Errors Guide.

---

Quick Diagnosis

1. Open the Slack credentials used by the node.
2. Verify the token type – a Bot User OAuth token starts with xoxb-.
3. Add the exact scopes required for the Slack action you’re calling (see the scope tables).
4. Re‑install the Slack app in the workspace so the new scopes are granted.
5. Save the updated token in n8n (or reference an environment variable) and re‑run the workflow.

If the error disappears, the permission issue is resolved. Otherwise, follow the full guide below.

1. Why “Permission denied” happens in the n8n Slack node

If you encounter any n8n google sheets node auth failure resolve them before continuing with the setup.

Root cause	What n8n sees	Typical Slack API response
Missing OAuth scopes	Token lacks the needed scope (e.g., chat:write)	{“ok”:false,”error”:”missing_scope”,”needed”:”chat:write”,”provided”:”…”}
Wrong token type	Using a User token (xoxp-) for a bot‑only endpoint	{“ok”:false,”error”:”not_allowed_token_type”}
App not re‑installed after scope change	Workspace still runs the old token	Same “missing_scope” error
Token revoked / expired	Token was manually revoked or rotated	{“ok”:false,”error”:”invalid_auth”}
Enterprise Grid / multiple workspaces	Token belongs to a different workspace	“not_in_channel” or “invalid_auth”

EEFA note: Grant only the scopes your workflow actually needs – least‑privilege reduces blast radius if the token leaks.

2. Identify the exact Slack API method your n8n node is calling

If you encounter any n8n mysql node authentication error resolve them before continuing with the setup.

n8n Slack node operation	Slack API endpoint	Typical use case
Send Message	chat.postMessage	Post a message to a channel
Add Reaction	reactions.add	Add an emoji reaction
Get Channel History	conversations.history	Retrieve messages from a channel
Invite Users	conversations.invite	Add members to a private channel
Update Message	chat.update	Edit an existing message

Micro‑summary: Knowing the endpoint lets you map the exact scopes required.

3. Required OAuth scopes per operation

Slack operation (n8n)	Required Bot scope(s)
Send Message (chat.postMessage)	chat:write
Add Reaction (reactions.add)	reactions:write
Get Channel History (conversations.history)	channels:history or groups:history
Invite Users (conversations.invite)	channels:manage or groups:write
Update Message (chat.update)	chat:write

Slack operation (n8n)	Required User scope(s)
Send Message (as user)	chat:write:user
Get Channel History (user)	channels:history or groups:history
(Other operations)	—

Tip: If you use the “Slack (Bot)” credential type, only the Bot scopes are needed.

4. Step‑by‑step fix checklist

If you encounter any n8n smtp node authentication error resolve them before continuing.

4.1 Open your Slack app configuration

• Go to https://api.slack.com/apps and select the app linked to n8n.

4.2 Check the token type stored in n8n

• In n8n → Credentials → Slack → look at the token prefix:
• xoxb- = Bot token (recommended)
• xoxp- = User token (only when you need user‑level actions)

4.3 Add missing scopes

• Navigate to OAuth & Permissions → Scopes and add every scope from the tables that matches the operations you use.

4.4 Re‑install the app

• Click Install App to Workspace (or Reinstall to Workspace if already installed) and approve the new permission request.

4.5 Refresh the token in n8n

Store the token in an environment variable (recommended for CI/CD safety):

# .env
SLACK_BOT_TOKEN=xoxb-1234567890-ABCDEFGHIJ

Reference the variable in the n8n credential JSON:

{
  "type": "slack",
  "token": "{{ $env.SLACK_BOT_TOKEN }}"
}

4.6 Run a test execution

• In the node UI click Execute Node.
• A response of { "ok": true, … } means the permission issue is solved.

4.7 Optional production hardening

• Enable Token Rotation in Slack (Settings → Token Management).
• Store the token in a secret manager (AWS Secrets Manager, HashiCorp Vault) and reference it via n8n’s Secret feature.

✅ Checklist completed? If any step fails, see the troubleshooting sub‑sections below.

5. Common pitfalls & how to avoid them

Symptom	Likely cause	Fix
missing_scope after adding scopes	App not re‑installed or old token cached	Re‑install the app and update the token in n8n.
not_allowed_token_type	Using a User token for a Bot‑only endpoint	Switch to a Bot token or add the corresponding user scope.
invalid_auth after a few weeks	Token revoked by Slack (security rotation)	Re‑install to generate a fresh token and update n8n credentials.
“Channel not found” when posting to a public channel	Bot not a member of the channel	Invite the bot to the channel or use conversations.join.
Rate‑limit (error":"ratelimited")	Too many rapid calls	Add a Retry node with exponential back‑off (see § 8.2).

EEFA warning: Never hard‑code the token in workflow JSON that is version‑controlled. Use environment variables or n8n’s encrypted credential storage.

6. Advanced: Workspace Apps vs. Classic Apps

Feature	Workspace App	Classic App
Token type	User token only (xoxp-)	Supports Bot token (xoxb-) and User token
Granular scopes	Yes (per‑resource)	Limited to predefined groups
Installation flow	Single‑click install for the whole workspace	Per‑workspace install (requires admin consent)
Recommended for n8n?	No – n8n’s Slack node expects Bot tokens for stability.	✅ Use Classic Bot app for production workflows.

If you created a Workspace App, you’ll see “not_allowed_token_type” errors. Convert it to a Classic Bot app (or create a new Classic app) and repeat steps 1‑5.

7. Real‑world production checklist

• Least‑privilege scopes – grant only what the workflow needs.
• Secret management – store SLACK_BOT_TOKEN in a vault, not in plain text.
• Token rotation policy – schedule a quarterly re‑install to obtain fresh tokens.
• Error handling – add an Error Trigger node that captures missing_scope or invalid_auth and sends an alert (email, Slack message to admin).
• Audit logs – enable Slack’s *App Management* logs to track scope changes.

8. Quick reference code snippets

8.1 Update the Slack credential via n8n CLI (self‑hosted)

n8n credential:update \
  --id <credential-id> \
  --type slack \
  --data '{"token":"{{ $env.SLACK_BOT_TOKEN }}"}'

8.2 Add a **Retry** node for rate‑limit handling

{
  "maxAttempts": 5,
  "delay": 2000,
  "exponentialBackoff": true,
  "retryOn": ["error", "ratelimited"]
}

Place this configuration on a **Retry** node that follows your Slack node.

10. Conclusion

Fixing “Permission denied” in the n8n Slack node boils down to three production‑grade practices:

1. Exact scope matching – grant only the Bot (or User) scopes required for the specific Slack API calls you use.
2. Token hygiene – store a Bot token (xoxb-) securely, re‑install the app after any scope change, and rotate tokens regularly.
3. Robust workflow design – add retry logic for rate limits and error‑trigger alerts for auth failures.

By following the checklist and code snippets above, your Slack‑enabled n8n workflows will run reliably in real‑world environments without recurring permission errors.