web/src/features/slack/README.md
This guide walks you through setting up and testing the Langfuse Slack integration for local development.
app_manifest.json from this directory and paste it into the manifest editorweb/public/icon512.png as your app's avataropenssl rand -base64 32 | tr -d "=+/" | cut -c1-32 to use as state secret.env file:
SLACK_CLIENT_ID=your_client_id_here
SLACK_CLIENT_SECRET=your_client_secret_here
SLACK_STATE_SECRET=your_state_secret_here
Slack's OAuth flow (and the Marketplace "Direct Install" flow) only redirects
back to a publicly reachable HTTPS URL — http://localhost:3000 is rejected
with bad_redirect_uri. The simplest way to get one in dev is a tunnel:
brew install ngrok):
ngrok http 3000
https://<subdomain>.ngrok-free.app URL.3000,
and set its visibility to Public. Use the printed
https://<id>-3000.<region>.devtunnels.ms URL.Then point Langfuse and Slack at that URL:
NEXTAUTH_URL in your .env to the tunnel URL (it is used to build the
OAuth redirect_uri):
NEXTAUTH_URL="https://<your-tunnel-host>"
https://<your-tunnel-host>/api/public/slack/oauth (the app_manifest.json
ships the localhost URL; replace/add your tunnel host).Tunnel hosts usually change each run (unless you have a reserved domain), so update both
NEXTAUTH_URLand the Slack redirect URL whenever it changes.
From the repository root, run:
pnpm run dev
The tunnel from step 4 terminates TLS and forwards to your local server, so plain HTTP dev is fine — no local certificates needed.
bad_redirect_uri / "Invalid redirect URI": NEXTAUTH_URL and the redirect
URL registered in your Slack app must both be the exact public HTTPS tunnel
host (https://<your-tunnel-host>/api/public/slack/oauth). A localhost or
http:// value will be rejected. If your tunnel host changed, update both..env file is in the correct location and contains the Slack credentialsThe Slack integration provides:
/api/public/slack/install/api/public/slack/oauthSlackService in the shared packageFor production deployment, ensure: