KeySkopeReviewed 2026-09-18
Preview: implemented and tested with fixtures; real-tenant acceptance testing is still required.
Before you start
- A Slack workspace and permission to install an internal app.
- Workspace approval if app installation is restricted.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| users:read | List workspace members and role/status flags. |
| users:read.email | Read member email addresses for identity matching. |
Connect Slack
- Create a Slack app from scratch for the workspace you want to review.
- Under OAuth & Permissions → Bot Token Scopes, add only users:read and users:read.email.
- Install the app to that workspace and complete any administrator approval.
- Copy the Bot User OAuth Token and enter it in KeySkope’s Slack connector. Use a dedicated app, not an existing bot with messaging scopes.
- Run a sync and compare an owner, regular member, guest and deactivated member with Slack.
Connection fields
| Setting | Purpose / value |
|---|---|
| bot_token | Dedicated Bot User OAuth Token, normally beginning xoxb-. |
What appears in KeySkope
- Human workspace members, email when returned, owner/admin/guest flags and deactivated status. Bots are excluded.
- No messages, files, private-channel content or activity history. This preview covers the token’s workspace, not every workspace in an Enterprise organisation.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| missing_scope | Check both bot scopes and reinstall the app after a scope change. |
| Broader token rejected | Create a dedicated app with just the two listed scopes rather than reusing a privileged bot. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.