Your chatbot, answering inside Slack
Create a Slack app, paste its bot token into WhisperChat and paste the Request URL back into Slack. Your team can then mention the bot in any channel or message it directly. Answers come from the same knowledge base as your website widget, arrive with their sources, and are logged in your dashboard — no bot process to host.
- A WhisperChat chatbot that has been trained at least once — Slack answers come from the same knowledge base as your website widget.
- A Slack workspace where you are allowed to install apps. Some workspaces require an admin to approve the installation.
- Nothing to install or host. Slack pushes events to WhisperChat over HTTPS.
Set it up in eight steps
Everything below happens in two places: api.slack.com/apps and your chatbot's Deploy page in WhisperChat. You will move between them twice — credentials come out of Slack, and the Request URL goes back in.
- 1
Create the Slack app
Open api.slack.com/apps and choose Create New App → From scratch. Give it a name — this is what your team will see — and pick the workspace it belongs to.
Open api.slack.com/apps - 2
Add the bot token scopes
Under OAuth & Permissions → Scopes → Bot Token Scopes, add all four. chat:write lets the bot reply, im:history lets it read direct messages sent to it, app_mentions:read lets it see mentions in channels, and users:read lets it show who asked by name instead of by Slack user ID.
Bot token scopeschat:write im:history app_mentions:read users:read - 3
Install the app and copy the bot token
Press Install to Workspace at the top of the same page and approve it. Slack then shows a Bot User OAuth Token starting with xoxb-. Copy it.
Token shapexoxb-1234567890-1234567890123-xxxxxxxxxxxxxxxxxxxxxxxx - 4
Copy the Signing Secret
Go to Basic Information → App Credentials and copy the Signing Secret. WhisperChat checks every incoming event against it, so an event that is not genuinely from Slack is rejected before it is read.
- 5
Connect it in WhisperChat
In your dashboard, open the chatbot, go to Deploy and press Connect on the Slack card. Paste the bot token and the signing secret, choose whether channel answers go into a thread, then press Connect Slack. WhisperChat validates the token and gives you a Request URL.
- 6
Paste the Request URL back into Slack
In your Slack app, open Event Subscriptions, switch Enable Events on and paste the Request URL. Slack immediately sends a signed challenge to it; when that succeeds the field turns green and shows Verified.
This is the step Slack cannot automate — there is no API for setting an app's Request URL, so it has to be pasted by hand. The WhisperChat dialog tracks whether it worked.
- 7
Subscribe to the two bot events
Still under Event Subscriptions, open Subscribe to bot events and add app_mention and message.im, then save. Slack may ask you to reinstall the app — do it, and the bot is live.
Bot eventsapp_mention message.im - 8
Invite it and ask something
Direct-message the app and it answers every message. To use it in a channel, run /invite @your-bot there, then mention it: “@your-bot what are your pricing plans?”
What your team gets
A connected Slack app behaves like every other WhisperChat surface — same answers, same history, same limits.
One knowledge base
Slack answers run through the same retrieval pipeline as your website widget. Train once; every channel stays in sync.
Threaded per conversation
Each Slack channel or DM gets its own conversation, so follow-up questions keep their context exactly like a browser conversation does.
Quiet in channels
In a channel the bot only answers a direct @mention. In a DM it answers every message, no mention needed.
Answers land in the thread
A channel mention is answered inside its thread by default, so a long answer never buries the conversation. Turn it off to reply in the channel instead.
Cited sources
When the answer came from crawled pages, up to three source links are appended to the reply.
Visible in your dashboard
Every question is logged as chat history with Slack as its source, so History, Insights and Leads include Slack traffic.
Try asking: “@your-bot what is our refund policy?” in a channel. The answer appears in that message's thread, with the pages it came from.
How it works
Useful if you are reviewing the integration before enabling it, or working out why something behaved the way it did.
Every event is authenticated twice
- The Request URL carries a per-chatbot secret, so an event can only ever be attributed to the chatbot it was issued for.
- On top of that, Slack signs each request with your Signing Secret. WhisperChat recomputes the signature over the raw body and rejects anything that does not match, or whose timestamp is more than five minutes old.
The answer is produced off the request
- Slack retries any event the Request URL does not acknowledge within three seconds, and retrieval plus generation take longer than that.
- WhisperChat acknowledges immediately and posts the reply from a background worker as a normal message, so a slow answer never turns into a duplicate.
A retry never answers twice
- Each Slack event ID is claimed in an idempotency log before the worker starts.
- A redelivery is acknowledged but never generates or bills for a second answer.
The bot never answers itself
- Slack delivers the bot's own posts back as ordinary message events, which would otherwise start an endless loop.
- Anything carrying a bot ID, a message subtype, or our own user ID is discarded before the pipeline is touched.
Long answers arrive in several messages
- Slack starts truncating a message past roughly 3,900 characters. Longer answers are split on line breaks and posted consecutively, so nothing is ever cut off.
- Markdown links and bold from the model are translated into Slack's mrkdwn, so the reply reads as formatted text rather than raw punctuation.
Messages and billing
- Each answered question costs one message from your plan, exactly like a widget conversation, with the same multiplier for premium models.
- When your subscription credits run out, a small daily grace allowance applies before the bot starts declining questions.
- A user's Slack ID is stored as the conversation's display name only. It is an identity, not contact details someone submitted, so it does not turn the conversation into a lead.
Credentials and privacy
Two secrets are involved — your bot token and your signing secret. Here is how they are handled, and what the bot can and cannot see.
What we store, and what you control
- Your bot token and signing secret are stored server-side and are never sent back to the browser — the dialog shows a masked placeholder instead, and leaving a field empty keeps the saved credentials.
- The bot only receives events you subscribed it to: mentions of it, and direct messages sent to it. Ordinary channel chatter is never delivered to WhisperChat.
- Disconnecting clears the stored credentials and invalidates the Request URL, so the endpoint starts rejecting every delivery immediately. Remove the app at api.slack.com when you want it gone from the workspace too.