Required and optional
Slack lets an app mark permissions as optional, and the app’s OAuth & Permissions page lists each one with Required: No. The agent works without them: a workspace that doesn’t grant one only loses that feature. Twelve permissions are required: without them the bot cannot receive a mention or a direct message, know who wrote, or be connected at all. Eight are optional. One more,chat:write.public, is asked for without an opt-out: Slack only lets an app mark it optional if chat:write is optional too, and the bot can’t answer without chat:write.
Permissions are only ever added. Installing again with a longer list adds the new ones to the same bot token.
Required permissions
Optional permissions
What is deliberately not there:
commands (no slash commands), users:write, and every *:write scope for channels, user groups or pins.
Events
Slack sends these to Lua. None of them needs a permission beyond the list above.Agent mode
An app set up in agent mode also asks for these. A plain app never does.Signing secret
Every event Slack sends is signed with the app’s Signing Secret (Basic Information → App Credentials). Lua asks for it when you connect and checks each event against it. The first event that matches confirms the secret; from then on Lua rejects any event that doesn’t match, so nobody can make the agent act on a forged message. Until that first match, an event that doesn’t match is still answered and the dashboard says the secret doesn’t match. A wrongly pasted secret never silences a working bot.Applying a newer manifest
Lua can’t change an app that belongs to your workspace; its owner applies each new version. The dashboard shows Update available on the Slack card until Slack has shown Lua the current manifest (a permission or a signed event only it brings) and the signing secret is saved. The update keeps your app’s own settings: the permissions it holds stay, and an app with slash commands, shortcuts or agent mode switched on in Slack merges its current manifest with Lua’s. The steps are in Update an existing app.Next steps
Connect Slack
Create the app, connect it, and choose when it answers.
Teams permissions
The same page for Microsoft Teams.