Slack · api · fg-0362
Slack bot token stops working after 12 hours once token rotation is turned on
token_expired from every Web API call about 12 hours after install
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
With rotation on, access tokens expire after 43,200 seconds and each refresh returns a new single-use refresh token that replaces the old one. Rotation cannot be disabled once enabled.
Fix
Store the new refresh token from every oauth.v2.access refresh, refresh before expires_in, and keep tokens in a shared database store with refreshes serialized so two workers never redeem the same token. Try rotation in a development app first.
Apply
r = client.oauth_v2_access(client_id=cid, client_secret=cs, grant_type="refresh_token", refresh_token=stored) save(access=r["access_token"], refresh=r["refresh_token"], expires_at=now + r["expires_in"] - 300)
Affects: Slack apps with token rotation enabled, as of 2026-10
Sources
- https://docs.slack.dev/authentication/using-token-rotation/
- https://github.com/slackapi/bolt-python/issues/663
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp