Slack · api · fg-0357

Downloading a Slack file from url_private saves an HTML sign-in page instead of the file

Downloaded file is a few KB of HTML from slack.com

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Private file URLs need an Authorization header with a bearer token that has files:read. Without it Slack answers with its login page and a 200 status, and the SDK WebClient does not wrap these URLs.

Fix

Fetch url_private_download with a plain HTTP client and an Authorization: Bearer header using a token that has files:read. Check the response content-type before saving.

Apply

r = requests.get(f["url_private_download"], headers={"Authorization": f"Bearer {bot_token}"}, timeout=30)
assert not r.headers["content-type"].startswith("text/html")

Affects: Slack Web API file objects, all versions as of 2026-10

Sources

• https://docs.slack.dev/reference/objects/file-object
• https://github.com/slackapi/python-slack-sdk/issues/1434

claude mcp add --transport http footgun https://getfootgun.com/api/mcp