Go ! Authentication using Slack

I am back with the implementation of Slack OAuth 2.0 implementation in Go. Let’s gain ground with the basics of OAuth 2.0 first.


OAuth 2.0 is an authorization protocol that allows users to grant limited access to their resources on one site to another application without exposing their credentials.The steps involved in the process are,

  1. The client is the application which tries to get the user information and it should get authorization from the Resource Owner.
  2. Once the Resource Owner authorizes the access, the client receives back an Authorization grant.
  3. The client requests an authorization token to Authorization server by passing the Authorization grant.
  4. If the grant is valid, the Authorization server issues back a token to the client
  5. Now the client can access the resources of the Resource Owner by passing the access token in each requests.

Let’s write some code in Go to access the resources from the Slack on behalf of an user.To begin with, we need to register our app with slack and slack provides a Client ID and Client Secret. Let’s hit https://api.slack.com/apps and register our application.

On successful creation of the app , I’m provided with the application’s unique Client ID and Client Secret.

Let’s start our code and we use the standard library package golang.org/x/oauth2 to assist us with the OAuth functionalities.

Create a Login URL

The first step is to create a login url which is encoded with Client ID and Client secret. These configuration urls can be saved in the config.go file.

Here the scope defines the api methods of Slack which the app is allowed to call. And we shall have our slackAuthentication.go file as follows with a method called SlackAuth which takes the Client ID, Client Secret, Scopes, Slack Authentication urls and gives back the encoded Login url.

When we curl the url, it gives back the url to OAuth 2.0 provider’s consent page that asks permission for the required scopes explicitly. The response of the curl looks like ,

When we hit the responses url in the browser, this is what we get,

When we click continue slack redirects to the redirect url which we must have specified while registering our application. The Authorization grant code will be passed by slack in the url.

Let’s write an Api to handle the redirection with the Authorization grant.

The code is very simple that the function accepts the parameter code and it makes an HTTP call to the the slack token url with the code. The Slack Authorization server responds back the Authorization token without an time expiry and the response will look like ,

So this Authorization token can be used by our application to call the Slack Apis to fetch the Resource owner details.

This is an simple implementation of Slack OAuth authentication in Go and the code is available in https://github.com/kanapuliAthavan/Interflow Feedback welcome!

See you next time with a new post :)

Originally published at www.athavankanapuli.com.