Docs · Connect your tools
Connect Slack
StackWeaver reads, and never changes, your Slack workspace's member list once a day, through a one-click, read-only approval. This guide says what is read, what access it needs, how to connect, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver lists your workspace's members. Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail. StackWeaver keeps counts and opaque Slack member ids. It never reads channels, messages, files or direct messages, and never stores names or e-mail addresses.
| Check (as shown in the portal) | What it looks at |
|---|---|
| Members with two-factor authentication on | How many active members have two-factor authentication on |
| Number of owners and admins | How many active owners and admins there are |
| Guest and restricted accounts | Counts of guest and restricted accounts |
| Deactivated member accounts | Counts of deactivated accounts |
2. What it does not do
- It does not read channels, messages, files or direct messages.
- It cannot post messages or change anything in your workspace.
- It does not store member names or e-mail addresses in the evidence.
- It does not say your workspace meets any standard. A result is what Slack returned at a certain time.
3. The access it needs
Three read-only scopes: users:read — view people in a workspace (Slack), including each member's two-factor status, owner/admin flag, guest/restricted flags and deactivated state; users:read.email, which Slack bundles with member listing (e-mail addresses are read but never stored); and team:read, basic workspace name and id, used to label the connection.
Who can connect. In StackWeaver, a workspace owner or admin starts the connection. On Slack's side, a workspace owner or admin approves the app; Slack does not expose an API for StackWeaver to separately confirm the approving person's role.
4. Connect steps
- In StackWeaver, open Evidence, the Slack section, and press Connect Slack.
- Sign in to Slack with a workspace owner or admin account if asked.
- Approve the three read-only scopes. You come back to StackWeaver, which tests the connection and shows the result.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check, or the feature needs a plan StackWeaver could not confirm |
| Could not check | StackWeaver could not read the data, or the check needs a higher plan than the account has |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Slack section. StackWeaver deletes the stored tokens and revokes the grant at Slack.
- If Slack could not be reached, a workspace owner can remove the StackWeaver app from Workspace Settings, Manage apps.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| The approval was declined, so nothing was connected | Press Connect again and approve the access |
| This Slack workspace is already connected to another StackWeaver workspace | Ask StackWeaver support if this is your workspace |
| Members with two-factor authentication on: Not enabled | Slack did not return two-factor status for StackWeaver's bot token; this needs a workspace owner or admin to re-approve with a user token |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.