Slack-Dev-201 Salesforce Certified Slack Developer Questions and Answers

The Events API enables Slack applications to react to activities occurring within Slack. An application subscribes to specific event types, and Slack delivers corresponding event payloads when those activities occur. Examples include messages being posted, reactions being added, members joining channels, files being created, and application mentions. The events available to an application are constrained by its OAuth scopes and the conversations or resources it is authorized to access. Slack can deliver Events API payloads through a public HTTP Request URL or through Socket Mode. After receiving an event, the application typically acknowledges delivery and asynchronously performs any associated business logic, such as calling `chat.postMessage`. The Events API does not manage billing, construct Block Kit layouts, or configure OAuth permissions. Therefore, B correctly describes its primary function.

Slack applications declare their requested OAuth permissions through application configuration. These permissions can be configured in the app settings under OAuth & Permissions or represented declaratively in an app manifest. Within a manifest, scopes reside under `oauth_config.scopes`, with separate fields for bot and user scopes. Slack's current platform also supports optional scopes through `bot_optional` and `user_optional`. The scopes determine what actions and data the application's tokens may access after authorization. Browser cookies do not define Slack app permissions, and the Slack CLI's local configuration is not the authoritative location for declaring the application's OAuth scope requirements. Scopes absolutely can—and normally should—be determined before installation so users and administrators can review the requested permissions during OAuth authorization. Therefore, A is correct.

Slash commands are application entry points that allow users to invoke Slack app functionality directly from the message composer. A user enters a forward slash followed by the registered command—for example, `/todo`—and Slack routes the resulting command payload to the associated application. The payload includes contextual information and any text entered after the command. The application must acknowledge the request promptly and can respond through mechanisms such as `respond()`, `say()`, or subsequent Web API operations. Slack's official documentation explicitly describes slash commands as allowing users to invoke an app by typing a string into the message composer. They are unrelated to message encryption, workspace theme configuration, or general channel deletion. Therefore, B accurately describes the purpose of Slack slash commands.

A clear privacy policy is a mandatory requirement for applications listed in what Slack now calls the Slack Marketplace. Slack requires the application's public landing page to provide a clear link to that privacy policy. The policy must explain, at minimum, what third-party data is collected, how that information is used, how long it is retained, and how individuals can request access, transfer, or deletion of their information. It must also provide a means of contacting the service regarding data-related requests. Slack specifically notes that even applications that do not actively use certain received data may nevertheless receive identifiers or other information through platform payloads, and this handling must be disclosed. Bank-account information is not a universal Marketplace submission requirement. A security assessment or penetration-testing report may become relevant for certain applications or review circumstances but is not the general listing requirement represented here. Slack also does not require every Marketplace description to be translated into every supported language. Therefore, B is correct. This belongs to Distribute Your App, specifically Marketplace listing requirements, privacy governance, and public application documentation.

Slack app-level tokens use the `xapp-` prefix. Unlike bot tokens, app-level tokens represent an application independently of an individual bot installation and are limited to specific application-level API capabilities. Socket Mode is a major use case. To establish Socket Mode, Slack requires an app-level token with the `connections:write` scope. That credential is supplied to `apps.connections.open`, which generates the temporary WebSocket URL through which Slack delivers Events API and interactive payloads. Slack's Socket Mode documentation also demonstrates storing this credential as `SLACK_APP_TOKEN` with a value beginning `xapp-`. By contrast, `xoxb-` identifies bot tokens and `xoxp-` identifies user tokens. `bearer-` is not a Slack token-prefix classification. Therefore, B is the verified answer.

An incoming webhook is a simple mechanism for sending messages from an external system into a predefined Slack destination. When an incoming webhook URL is created, Slack associates that URL with a specific user and a specific channel. Current documentation states explicitly that the generated URL is tied to one channel. The webhook therefore works particularly well when an external service has a straightforward requirement such as sending alerts, notifications, or status information into one predetermined channel. The integration makes an HTTP POST containing a JSON message payload to the webhook URL. Option A conflicts with the fundamental behavior of a single incoming webhook URL. To support multiple destinations, separate webhook URLs or more flexible Web API methods may be required. Option D is also incorrect because incoming webhooks intentionally provide less destination flexibility than methods such as chat.postMessage. Slack specifically notes that an incoming webhook cannot override its configured destination channel, username, or icon through the message payload. Consequently, C accurately represents the architectural reason for selecting an incoming webhook. This maps to Design Your Workflows: Spotlight on Slack's APIs, particularly choosing between webhooks and Web API messaging methods.

Slack bot tokens use the `xoxb-` prefix. These tokens represent the application's bot identity within an installed Slack workspace and carry the granular bot OAuth scopes granted during installation. Slack's official token documentation explicitly states that bot token strings begin with `xoxb-`. Developers must treat these values as secrets because possession of a valid token can permit API operations authorized by its associated scopes. Credentials should therefore be stored in a secure secrets-management system or protected environment rather than embedded in source code or exposed in logs. The `xapp-` prefix belongs to app-level tokens, which are used for application-level functionality such as Socket Mode. The remaining prefixes do not represent the standard Slack bot token type described by this question. Therefore, option A is correct.

Slack's current Agent quickstart guides developers through creating an AI-powered Slack agent. The official quickstart uses a sample support agent named Casey and demonstrates building the application with the Slack CLI and Bolt frameworks while integrating supported AI agent frameworks such as the Claude Agent SDK, OpenAI Agents SDK, or Pydantic AI. The resulting agent can interact through direct messages, app mentions, App Home, modals, reactions, and threaded responses. Developers begin by installing the Slack CLI, authenticating with a workspace, and creating the agent project using the provided sample template. This is application-development guidance for Slack's AI agent platform, not billing, workspace theming, or Block Kit Builder extensions. Therefore, B precisely matches the purpose of the Agent quickstart.

The official Slack Developer documentation provides a dedicated Agent quickstart specifically for developers beginning an AI-powered Slack agent project. The quickstart covers the essential starting workflow: installing Slack CLI, logging into a development workspace, creating the support-agent sample project, selecting an AI agent framework, configuring required credentials, and running the application locally with `slack run`. Slack's general application quickstart also directs developers who want to explore agent development to the Agent quickstart as the next starting point. The pricing, legal, and Marketplace pages do not provide the implementation sequence needed to build an agent. Accordingly, the developer documentation path identified in option A is the appropriate first technical resource. The PDF's supplied answer is therefore verified as correct against Slack's current documentation.

application/json is the appropriate Content-Type because Slack webhook-triggered workflows consume structured JSON payloads. When configuring a webhook workflow, Slack allows the workflow creator to define input variables and generates a request body containing corresponding JSON key-value pairs. The external application sends an HTTP POST request to the generated hooks.slack.com/triggers/... endpoint with values matching those defined inputs. JSON is the correct representation because it allows Slack to deserialize individual workflow variables predictably. Slack's webhook-related developer examples likewise show HTTP POST operations with Content-Type: application/json and a JSON body. multipart/form-data is normally appropriate for multipart uploads, not this trigger payload. text/plain would not provide the structured object Slack expects. application/x-www-form-urlencoded is associated with traditional form encoding and some older HTTP integrations, but it is not the format prescribed for the Workflow Builder webhook payload described here. The webhook URL itself must also be protected because possession of the URL can allow an external party to trigger the workflow. This maps directly to Design Your Workflows: Spotlight on Slack's APIs, specifically webhook-triggered workflow automation.

Retention policies govern how long Slack conversation content is preserved before eligible data is deleted according to administrative policy. Slack provides Enterprise administrative functionality for configuring custom conversation retention, including the `admin.conversations.setCustomRetention` method. The official method description states that the endpoint sets a conversation's retention policy and requires an appropriately authorized user token with the `admin.conversations:write` scope. Retention settings concern conversation data lifecycle and organizational information-governance requirements; they are unrelated to OAuth scope expiration, Block Kit Builder history, or bot-token rotation. Administrators can use retention controls to enforce organizational, regulatory, privacy, or records-management requirements on Slack content. Consequently, among the available choices, A correctly identifies custom retention as controlling how long message and associated conversation content is retained.

`api.slack.com/apps` is Slack's web-based application dashboard for viewing and managing registered Slack applications. After signing in, developers can select an app and configure application features, OAuth permissions, event subscriptions, interactivity, distribution, collaborators, credentials, manifests, and related settings. The page remains active and presents the developer's “Your Apps” interface. `slack.com/billing` is associated with account and subscription matters rather than application configuration. `docs.slack.dev/tools` provides developer documentation and does not function as the management dashboard, while `app.slack.com/downloads` is unrelated to app configuration. Although Slack has progressively moved developer documentation from the older API documentation structure to `docs.slack.dev`, the app-management dashboard at `api.slack.com/apps` remains the correct web interface identified by this question. Therefore, A is correct.

Workflow Builder is intentionally designed as a no-code automation environment, so ordinary workspace members can create workflows without being software developers. Slack currently states that, by default, all regular members can access Workflow Builder and create workflows, although owners and administrators can restrict who has permission to do so. In Enterprise organizations, Org Owners and Org Admins can similarly establish organization-level policies governing workflow creation. Workflow Builder therefore enables business users to automate routine processes using triggers, forms, Slack actions, connector steps, and other visual components. It is not restricted to Slack employees, certified developers, or Enterprise Grid owners. The important qualification in option B is “with the appropriate permissions,” because administrative policies can narrow the default access. Therefore, B is the correct answer.

Under Slack's current SCIM documentation, Org Owner is the valid role for installing a SCIM application in an Enterprise organization. Slack requires an OAuth token carrying the admin scope for SCIM operations. Both Org Owners and Org Admins may subsequently use SCIM functionality to modify users, provided the token-generating account retains sufficient privileges. However, Slack explicitly distinguishes token usage from application installation: only an Org Owner can install the SCIM app on an Enterprise organization. Therefore, the supplied question is structurally defective because it instructs the candidate to “Choose 2 options,” while current official Slack SCIM requirements yield only one correct choice from the available options: D. An App Collaborator is an application-development role and does not confer Enterprise administration authority. Apps Admin and Moderator likewise do not satisfy SCIM installation requirements. Org Admin is relevant to SCIM administration and certain admin.* APIs, but is not sufficient for installing the SCIM application itself. The source bank marks C and D; that key should be corrected. This belongs to APIs for Managing Your Slack, particularly SCIM provisioning, administrative authorization, and Enterprise organization role requirements.

`app.action()` registers a Bolt action listener for interactions generated by Block Kit interactive components. Examples include button clicks, select-menu choices, overflow-menu selections, date-picker interactions, and other components that generate an `action_id`. The developer associates the listener with an action identifier or matching pattern, and Bolt invokes the registered function when Slack delivers the corresponding interaction payload. Slack's official Bolt examples demonstrate `@app.action("button_click")` for handling a button whose `action_id` is `button_click`. The listener should promptly call `ack()` so Slack knows that the interaction was received, after which the application can update a message, call an API, open another surface, or perform backend processing. `app.click()`, `app.select()`, and `app.interactive()` are not the standard Bolt listener methods for handling these Block Kit actions. Therefore, A is correct.

Option B provides the strongest Slack-platform architecture because the process requires individualized status tracking, integration with an external system of record, recurring reminders, and escalation when employees remain noncompliant. Slack apps are specifically intended to automate tasks and connect Slack with external business systems. The application can determine each employee's compliance state externally and send targeted Slack notifications only where action is required. A quarterly announcement workflow is insufficient because it treats every employee identically and cannot distinguish completed from outstanding obligations. It also lacks an escalation mechanism. Option C unnecessarily places compliance training and acceptance inside Slack even though the scenario identifies an external system of record. That creates duplicated state and introduces additional governance concerns around which system represents the authoritative acceptance record. Slack's application-design guidance also cautions against noisy broad notifications. Targeted communication is preferable where a service concerns an individual user, and manager escalation can be generated only for unresolved cases. This maps to Apps in the Slack Platform, particularly recommending how Slack applications can automate organizational operations and integrate existing business processes with external systems.

`users.info` is the Slack Web API method for retrieving information about a specific workspace member. The application supplies the user's Slack ID through the `user` argument and must use a token containing the `users:read` scope. A successful response returns a user object containing properties such as the member's ID, name, profile attributes, timezone information, account state, and other available fields. If the application requires the user's email address, Slack additionally requires the `users:read.email` scope. Developers can also request locale information by setting `include_locale=true`. `user.get`, `profile.lookup`, and `team.userInfo` are not the supported Web API methods for this operation. Slack's current method reference explicitly describes `users.info` as obtaining information about a user. Therefore, A is correct.

App Home is the strongest primary surface because the requirement involves persistent management of structured, user-specific information. Employees must repeatedly return to the application to create, edit, and review timesheet data rather than perform only a single transient action. Slack defines App Home as a private one-to-one space between a user and an application. Its Home tab remains available in a predictable location and retains its interface until the application republishes or updates it. Slack specifically recommends App Home for personalized dashboards, task views, user-specific information, settings, and persistent application workflows. A timesheet application can therefore display the employee's current pay period, submitted entries, outstanding hours, approval status, and actions for adding or modifying records. Individual edit/create operations could subsequently open a modal, but the modal would be a supporting interaction surface rather than the application's principal workspace. Messages are better suited to notifications and conversational interactions. Threads organize message-based discussion and do not provide an appropriate persistent management dashboard. Therefore, A correctly follows Slack's surface-selection guidance. This question belongs to Design a Great User Experience, especially persistent personalized interfaces and selection of the appropriate Slack surface.

The `slack login` command authenticates the Slack CLI with a development workspace. During this process, the CLI guides the developer through authorization so subsequent commands can operate in the selected Slack environment. This is a prerequisite for common development tasks such as creating, running, and installing a Slack app through the CLI. Slack's quickstart documentation explicitly instructs developers to run `slack login` after installing the CLI and before starting the app-development workflow. The other options are not the documented authentication command: `slack auth`, `slack connect`, and `slack workspace add` do not perform the standard CLI login flow described by Slack. Therefore, B is correct because `slack login` is the supported command for connecting and authenticating the Slack CLI to a workspace.

The `say()` utility is commonly injected into Bolt listener functions to send a message back into a Slack conversation. In Bolt for Python, Slack demonstrates listener functions such as `def message_hello(message, say):`, where calling `say()` sends a message to the conversation in which the triggering event occurred. The helper abstracts the underlying `chat.postMessage` operation and automatically uses relevant conversation context, although developers can also explicitly specify a channel when required. `reply()` and `send()` are not standard injected Bolt listener utilities for this purpose, while `respond_to()` is not a documented Bolt listener parameter. Slack's Bolt framework intentionally provides context-aware utilities such as `say`, `ack`, `respond`, and `client` to simplify common interaction patterns. Therefore, option C correctly identifies the standard reply helper used by Bolt listeners.

A Slack application created for use exclusively inside its associated workspace does not need public distribution or a multi-workspace OAuth installation architecture. Slack classifies such an application as an undistributed or single-workspace app. It can be installed directly into its associated development workspace through the app-management configuration. Because the IT manager needs access to the app's configuration, adding that person as an application collaborator provides the appropriate administrative access. The collaborator can then install the application to the Business Operations workspace through the app dashboard. Option A unnecessarily enables distribution to other workspaces. Once public distribution is activated, Slack provides a shareable installation URL intended for multi-workspace installations. Option C similarly introduces OAuth infrastructure that is required when distributing an application beyond its associated workspace but is unnecessary for this internal single-workspace scenario. Option D is even broader because Slack Marketplace publication is intended for externally distributed applications that have completed Slack's review process. Slack's current lifecycle documentation confirms that newly created apps reside in an associated workspace and can be installed there directly without building a separate authorization flow. This belongs to Distribute Your App, particularly understanding single-workspace versus distributed application models.

Slack requires an application using HTTP Events API delivery to acknowledge an event request with an HTTP `2xx` response within three seconds. If Slack does not receive a successful acknowledgment in that period, the delivery attempt is treated as unsuccessful and Slack may retry the event. Slack recommends responding with `HTTP 200 OK` as rapidly as possible and separating event ingestion from potentially slow business processing. A robust production architecture typically acknowledges the request immediately, places the event on a queue, and performs downstream processing asynchronously. This prevents expensive API calls, database operations, or external-service dependencies from delaying acknowledgment and producing duplicate deliveries. Returning Block Kit content is unnecessary for acknowledgment, while user logout and scope requests are unrelated. Therefore, A is correct and represents an important Slack scalability and reliability pattern.

The Discovery API is specifically designed for Enterprise security, compliance, archiving, and eDiscovery use cases involving extraction of Slack content into approved third-party systems. Slack explicitly describes eDiscovery applications as pulling messages and files from Slack and storing the information in third-party data warehouses, where that content can subsequently be searched, archived, or retrieved. The Discovery API can provide organization-level message and file information, including historical content that remains available under applicable retention and legal-hold policies. Its use is restricted to approved security and compliance scenarios such as eDiscovery, archiving, and Data Loss Prevention. The Audit Logs API provides administrative and security event records rather than the actual body of message and file content needed for an external archive. Admin APIs manage Enterprise configuration and administrative resources. Legal Holds preserve relevant Slack data from deletion or retention-policy expiration but are not themselves the general extraction mechanism described in the scenario. Therefore, D directly matches the legal department's requirement to transfer Slack content into a third-party data warehouse. This question belongs to APIs for Managing Your Slack, specifically Enterprise content governance, eDiscovery, archiving, and Discovery API use cases.

Slack applies OAuth authorization at the API-method level. If an access token does not contain the scope required by the requested Web API operation, Slack rejects the call rather than silently granting additional privileges or returning unauthorized data. A common response is the `missing_scope` error, which indicates that the token lacks the specific scope permissions necessary to complete the operation. Slack's permissions model therefore enforces least privilege: an application's token can perform only the actions authorized through its granted scopes. Adding a scope to app configuration does not automatically upgrade an already issued token; existing installations may need reauthorization when new required scopes are introduced. Slack also does not normally email an administrator merely because an API request lacks a scope. Therefore, B accurately represents Slack's authorization behavior.

A message posted to an authorized conversation is a standard example of activity that can generate an Events API notification. Slack provides specific message event subscriptions for different conversation types, including `message.channels`, `message.groups`, `message.im`, and `message.mpim`. The exact events an application receives depend on its subscribed event types, granted OAuth scopes, and access to the relevant conversation. Slack's own Events API walkthrough uses a message posted in a channel containing a bot as a canonical example: Slack sends the event to the application, the server acknowledges it, and application logic can then respond using a Web API method such as `chat.postMessage`. A user's local clock, browser-tab changes, and ordinary billing renewal are not Events API event triggers represented by these developer subscriptions. Therefore, A is correct.

Slack's documented macOS and Linux installation method uses the official shell installer hosted on Slack's downloads domain. The command `curl -fsSL https://downloads.slack-edge.com/slack-cli/install.sh | bash` retrieves the installer securely and runs it through Bash, installing the Slack CLI and making the `slack` command available for development. Slack's current CLI installation documentation presents this command as the supported installation path for macOS and Linux. The alternatives do not represent the official installation command in the Slack Developer documentation: Slack CLI is not installed through the listed npm or pip commands, and `brew install slack` does not correspond to Slack's documented CLI installer. Therefore, option B is the verified installation command for the environments named in the question.

Slack AI agents are built on the core Slack application platform rather than an entirely isolated development system. Slack's agent documentation describes Slack as particularly suitable for agent experiences because it already provides a conversational environment, Block Kit interaction model, multiple application surfaces, identity, permissions, and contextual information. The official Agent quickstart demonstrates an agent using familiar Slack application mechanisms such as Bolt, App Home, modals, direct messages, app mentions, reactions, and threaded messaging. Developers can therefore combine AI reasoning and external model frameworks with established Slack primitives for events, messages, interfaces, authentication, and Web API actions. Agent functionality may introduce specialized capabilities and scopes, but it does not replace the underlying Slack platform. Agents can also post and stream responses. Consequently, B is the technically correct answer.

Slack distinguishes between a development application installed only in its associated workspace and an application intended for installation across multiple workspaces. For a single-workspace application, Slack allows installation directly through the application's configuration without requiring the developer to implement a complete OAuth installation flow. Once an application is distributed to other workspaces, however, each installation must be explicitly authorized. Slack therefore requires the application to implement the OAuth 2.0 authorization-code flow and store the resulting installation information, including the applicable access tokens. OAuth is not required merely because an application has slash commands or a bot user. Those features require appropriate scopes and application configuration, but they do not independently dictate multi-workspace OAuth installation. OAuth is also not simply an optional additional security layer; it is Slack's authorization mechanism for obtaining workspace-specific authorization during distributed installation. The application typically sends the installer to Slack's authorization endpoint, receives a temporary authorization code through its configured redirect URI, exchanges that code through oauth.v2.access, and securely stores the resulting installation credentials. Therefore, C is correct and maps directly to Distribute Your App, particularly multi-workspace installation and OAuth-based authorization.

Public channels are the only conversation type among these choices for which Slack provides an explicit permission enabling an app to post without first becoming a member. The relevant permission is the chat:write.public scope, used together with chat:write. Slack describes chat:write.public as permitting a Slack app to send messages to public channels in which the application is not a member. Without that additional scope, an app normally must join the public channel or be invited before posting. Private channels require appropriate membership and authorization because allowing an app to post into a private conversation without membership would violate Slack's privacy model. Likewise, ordinary direct messages and multi-person direct messages have different membership and conversation-opening semantics and are not equivalent to posting freely into a public channel. The wording “by default” in the source is somewhat imprecise because granular-permission Slack apps do not automatically receive access to all public channels. They must request chat:write.public. Nevertheless, among the four conversation types, D represents the intended and technically supported capability. This question aligns with Design Your Workflows: Spotlight on Slack's APIs, particularly chat.postMessage, conversation membership, and OAuth scope behavior.

Slack's standard Bolt quickstart supports starter projects for Python and JavaScript. The Slack CLI workflow lets a developer create a sample application using Bolt for Python or Bolt for JavaScript and then run that project in a development workspace. Both frameworks provide higher-level abstractions for common Slack application patterns, including event listeners, interactive actions, Web API clients, acknowledgments, and context-aware utilities. Slack also maintains Bolt for Java as an official framework, but the particular starter-template choice described by the standard quickstart is Python or JavaScript. Ruby, Go, C#, PHP, Rust, and Swift are not the two out-of-the-box starter choices represented in this question. Therefore, B correctly identifies Python and JavaScript as the standard Bolt starter-template languages in the Slack CLI quickstart.

GovSlack is a separate Slack environment specifically designed for U.S. public sector organizations and their security and compliance requirements. Slack states that GovSlack enables agencies, contractors, citizens, and partners to collaborate through an environment designed for stringent public-sector operational requirements. GovSlack operates separately from commercial Slack on the `slack-gov.com` domain, with data isolated from the commercial Slack environment. It runs in AWS GovCloud-certified infrastructure and supports compliance requirements including FedRAMP High. Developers making commercial Slack apps available in GovSlack must separately configure and deploy them for that environment and follow GovSlack-specific API, OAuth, credential, and Marketplace requirements. It is therefore neither a personal free-workspace product nor a Marketplace testing environment. Answer A is correct.

Slack shortcuts provide explicit entry points that users can invoke to start application functionality. Slack supports two principal shortcut types: global shortcuts and message shortcuts. Global shortcuts can initiate functionality without requiring an existing message context, while message shortcuts are attached to individual messages and appear in the message context menu. When a shortcut is invoked, Slack sends an interaction payload to the application containing contextual information and a `trigger_id`, which can be used to open a modal or continue another interactive flow. Webhooks are message-delivery mechanisms rather than user action entry points. OAuth scopes define permissions, while manifests describe application configuration. Consequently, Shortcuts is the Slack feature specifically designed to let users invoke application actions from Slack UI locations.

The `plain_text_input` element is specifically intended to collect free-form textual information from users. Slack allows the element to accept either single-line or multiline text and commonly places it inside an `input` block when constructing a modal form. The application receives the entered value when the modal generates a `view_submission` payload, allowing the backend to validate and process the submitted information. A button initiates an action rather than collecting text. A `static_select` element presents predefined choices, while an overflow menu provides a compact collection of predefined actions or selections. Neither alternative allows unrestricted textual entry. Slack's Block Kit element reference explicitly identifies the plain-text input element as the component for entering free-form data. Therefore, B is the correct element for collecting textual input inside a modal.

A Slack application distributed across multiple independent workspaces must implement an OAuth installation flow. Slack explicitly states that enabling installation on other workspaces allows the application to generate access tokens for each workspace and applicable user authorization. Bolt's current OAuth documentation likewise explains that each app installation issues unique access tokens and installation information that the application must store securely and retrieve when processing requests. This is fundamentally different from a single-workspace application, which can receive one access token through direct installation without implementing the full distributed OAuth flow. Independent workspaces do not normally share one universal token. Organization-wide Enterprise installations are a distinct model and can use an organization-level authorization, but that does not invalidate the standard multi-workspace distribution behavior tested here. Therefore, A is correct.

Slack's current architecture guidance explicitly favors HTTP Request URLs for production applications when Socket Mode is not required. WebSockets are stateful, which makes them more complex to scale horizontally and more susceptible to connection interruptions, network partitions, and transient disconnections. Slack describes Socket Mode as particularly convenient for local development, on-premises integrations, environments behind firewalls, or applications unable to receive inbound HTTP traffic. For maximum application-connectivity reliability, Slack recommends HTTP for production applications and advises developers to continue using HTTP request URLs when their deployment does not specifically require Socket Mode. Socket Mode also does not replace the Web API; applications commonly receive events over Socket Mode and then invoke Web API methods to perform actions. Therefore, B accurately reflects Slack's present production-scale guidance.

Slack applications receiving HTTP requests must verify Slack's cryptographic request signature using the application's signing secret. Slack includes an `X-Slack-Signature` header and request timestamp with signed requests. The application constructs a signature base string from the timestamp and raw request body, calculates an HMAC-SHA256 signature using its signing secret, and securely compares the calculated value with Slack's supplied signature. Developers should also validate the request timestamp to reduce replay-attack exposure. This provides strong evidence that the payload originated from Slack and was not modified after signing. Country information and browser user-agent strings provide no cryptographically reliable authentication, while the workspace's subscription plan is entirely unrelated to request integrity. Slack recommends signing-secret verification instead of the deprecated verification-token approach. Therefore, B is correct.

The application currently needs only two capabilities: detect messages containing “hello” in public channels where it is already present, and post a response. Receiving public-channel message events requires the channels:history scope when subscribing to the message.channels event. Sending a response as the application requires chat:write. Therefore, D provides exactly the permissions required by the functionality available at release. The planned capabilities to independently join public channels and add reactions are explicitly scheduled for the following year. Slack's least-privilege principle requires applications to request only permissions required by functionality that presently exists. Requesting channels:join or reactions:write before those capabilities are implemented would unnecessarily expand the application's authorization footprint. Current Slack Marketplace guidance reinforces this requirement and states that applications should not submit scopes intended only for future functionality. Therefore, the correct release-time scopes are chat:write and channels:history. Additional scopes should be requested later when the associated features are implemented and ready for use. This maps to Design for Security, particularly granular OAuth scopes, least privilege, Events API authorization, and permission lifecycle management.