--- title: "Connect Slack for notifications and approvals" description: "Get approval requests and server alerts in a Slack channel and approve from Slack. Learn who can connect Slack, how to set the channel, and what to check." --- > Full documentation index: https://docs.alpacax.com/llms.txt # Connect Slack for notifications and approvals # Connect Slack for notifications and approvals Receive approval requests and server alerts in Slack, and respond to requests from a message. ## Slack integration options Connecting Slack brings approval requests and server alerts into a Slack channel your team already watches, and lets approvers approve or reject a request from the message without opening the console. This page covers the Slack app integration under **Integrations**. Posting notifications to Slack through an incoming webhook is a separate, simpler option; see [Slack app or Slack webhook](#slack-app-or-slack-webhook). ## What Slack gets you - **Approval requests in a channel.** Each request is posted as a card with **Approve** and **Reject** buttons. A decision made in Slack counts the same as one made in the console, and the card then shows the result and who decided. Requests raised inside one work session share a thread; see [Approving from Slack in a work session](/use/approvals/reviewing/#approving-from-slack-in-a-work-session). - **Alerts in the same channel.** Servers that go offline, metric alerts whose rule posts to Slack, and logins that reached a server without Alpacon are posted there too. Critical AI session analysis results are always posted. High results are posted only when the workspace doesn't receive periodic reports. See [Notifications & webhooks](/reference/notifications/#what-triggers-a-notification) and [Session risk analysis](/reference/notifications/#session-risk-analysis). - **Direct messages.** A member whose Slack account is linked gets a direct message from the Alpacon app when another approver decides their request, and, when they can approve their own work session request, that request first. Members manage their Slack DMs in [Notification preferences](/use/settings/notifications/). Some requests can't be settled with a button, for example those that need MFA. Their card links to the console instead; see [What a Slack card shows](#what-a-slack-card-shows). ## Who can connect Slack - **Plan**: Essentials or Enterprise. On the Free plan the Slack card under **Integrations** shows an upgrade prompt and the connection is refused. See [Plans & billing](/use/workspace/plans-billing/). - **Role**: a Superuser connects Slack, sets the channel, links members, and disconnects. **Integrations** is in the admin section of the left sidebar. - **One Slack workspace per Alpacon workspace.** To move to a different Slack workspace, disconnect the current one first. You also need to be allowed to install apps in the Slack workspace you connect. ## Connect Slack ### Open the Slack page Click **Integrations** in the left sidebar, then the **Slack** card. ### Allow the Alpacon app Click **Connect Slack**. Slack opens and asks you to allow the Alpacon app in your Slack workspace. Allow it within about 10 minutes; if you take longer, or cancel, nothing is connected and you can start again. ### Check the connection You return to the Slack page, which shows your Slack workspace's name marked **Connected**. Members whose Slack email matches their Alpacon email are linked at this point. ### Set the channel Choose the channel that receives posts, as described in the next section. Nothing is posted to a channel until one is set. ## Permissions the Slack app requests Slack asks you to approve these permissions when you connect the app. You can review the granted permissions later under **Scopes** on the Slack page. | Permission | What Alpacon uses it for | | --- | --- | | `chat:write`, `chat:write.public` | Post approval requests and alerts to the chosen channel, including public channels the app has not joined | | `im:write` | Send direct messages about requests and decisions | | `channels:read`, `groups:read` | Look up public channels and private channels the app belongs to | | `users:read` | Find Slack members and their profiles for account linking | | `users:read.email` | Match Slack members to Alpacon accounts by email | ## Choose the channel The **Notification channel** card on the **Overview** tab sets the channel: 1. In Slack, find the channel's ID (for example `C0123ABCD`) in the channel's details. 2. Enter it in **Default channel ID** and click **Save**. Once saved, the card shows the channel's name next to the ID and the status **Notifications on**. To stop channel posts, clear the field and save; the status changes to **Notifications off**. The Alpacon app can post to a public channel without being a member. For a private channel, invite the Alpacon app to the channel first. One channel carries approval requests, server alerts, and direct-login alerts. Critical AI session analysis results are always posted there. High results are posted only when the workspace doesn't receive periodic reports. See [Session risk analysis](/reference/notifications/#session-risk-analysis). Cards show who asked for what, command lines, server names, and accounts, so keep the channel to your approvers and reviewers. On the Free plan the channel can't be changed, so a workspace that downgrades keeps the channel it had. Disconnecting still works on every plan. To check the channel, ask a member to submit a work session request that actually waits for an approver, then look for its request card in Slack. A request admitted without review does not produce an approval card. The connection page does not offer a test-notification button. If no card arrives, check [When messages stop arriving](#when-messages-stop-arriving). ## Link members to Slack The buttons work only for a member whose Slack account is linked to their Alpacon account, and only linked members get direct messages and mentions. When Slack is connected, every member whose Slack email matches their Alpacon email is linked automatically. Anyone who joins later, or whose emails differ, is linked by a Superuser: 1. Open the **Users** tab on the Slack page. It lists linked members, with **Email match** or **Manual** as the link's method. 2. Click **Link user**, pick the Alpacon user and the Slack member, and save. Both lists show only accounts that aren't linked yet, and only people in the connected Slack workspace can be linked. **Unlink** in a row's menu removes a link. A channel card mentions people in two cases. When a request you could approve yourself reaches the other approvers, its card mentions those whose accounts are linked; see [When you can approve your own work session request](/reference/notifications/#when-you-can-approve-your-own-work-session-request). In a work session thread, replies mention the approvers who approved the session or one of its requests that was posted to the channel; see [Approving from Slack in a work session](/use/approvals/reviewing/#approving-from-slack-in-a-work-session). ## What a Slack card shows An approval card leads with a headline naming the requester, and the AI agent when there is one, and what they ask for. Below it: - Except for session extensions, **Type** and **Submitted**, the time the request was made, with its UTC offset. - What the request is for: an account or group name, a token name, a work session's title, or a held command's whole command line. - For a held command, its **Risk level** and, when it runs with `sudo`, **Privilege**. See [Held commands that run sudo](/use/approvals/reviewing/#held-commands-that-run-sudo). - For a held command, **Origin** and **Session**, described below. - For a work session, **Target account**, the account the session runs as. - The requester's description, the reason the request needs approval with a link to your Access rules, and the name of the Alpacon workspace it came from. A session-extension card shows **Expiry** (the current and requested end, with the added time, such as `21:32 → 23:32 UTC-7 (+2 h)`) and **Target servers** (the first five, then `+N more`). It has no Type or Submitted fields. It keeps the requester headline, description, approval reason, and buttons, and shows **Origin** for a token request. The decision deadline, assignee, original approval, and extension count are in the console only. ### Origin and session A held command's card says where the command came from: - **Origin** names the token the command ran with: `API token deploy-bot (jane)` for an API token, with the person it belongs to, or `Service token ci-runner (app release-bot)` for a service token, with its application. A command run interactively, without a token, has no **Origin** field. - **Session** names the work session the command ran in, and who opened it, for example `Patch web servers (opened by jane)`. **No work session** means the command ran outside any work session, which a token can do. Read that as a sign to check the command more closely. Both stay on the card after the request is decided. ### The buttons - **Approve** and **Reject** settle the request directly. - A single button that opens the console replaces them when the decision has to be made there: a request that needs MFA, a command too long to show in full, or a request that runs a script. The card says which. See [When a decision asks for MFA](/use/approvals/reviewing/#when-a-decision-asks-for-mfa). - Only **Reject** is offered when the request can't be approved, for example because the sudo policies changed after it was made. The card says why. When a request needs more than one approval, clicking Approve records your vote, and only you see "Vote recorded (1/2 approvals)." The card keeps its buttons until the request is decided. Once it is, from Slack or the console, the card changes to the result and who decided it. A click on a card whose request is already decided answers "This request has already been reviewed." If you made the request, another approver decided it, and your Slack account is linked, you also get a direct message with the decision. A request you decide yourself sends you none. ## Disconnect Slack On the **Overview** tab, click **Disconnect** and type the Slack workspace's name to confirm. Disconnecting stops every post and direct message from the Alpacon app, removes the Alpacon app from your Slack workspace, removes the channel setting and every member link, and removes Slack as an approval channel. Requests can still be decided in the console, and a [Slack webhook](#slack-app-or-slack-webhook) keeps posting. Connecting again starts over: set the channel again, and link by hand anyone the email match doesn't cover. ## When messages stop arriving Check these in order: - **The channel is set.** If the **Notification channel** card shows **Notifications off**, no channel is set and nothing is posted to one. - **The app can post to the channel.** For a private channel, invite the Alpacon app to it. If a public channel still gets nothing, invite the app there too. - **The Alpacon app is still installed in Slack.** If someone removed the app on the Slack side, Alpacon still shows Slack as connected but nothing arrives. Click **Disconnect**, then **Connect Slack** again. - **The alert is one that posts to Slack.** A metric alert posts only when its rule's Slack channel post is on and its severity allows it; see [What a rule can carry](/use/servers/monitor/#what-a-rule-can-carry). Some notifications are never posted to Slack; see [Notifications & webhooks](/reference/notifications/#what-triggers-a-notification). - **Your direct messages are on.** A missing DM can mean your Slack account isn't linked, or Slack DM is off in your [notification preferences](/use/settings/notifications/). No decision DM comes for a request you decided yourself. If a button answers "This Slack account isn't linked to Alpacon. Ask an admin to link it.", ask a Superuser to [link your account](#link-members-to-slack). If it answers "You are not authorized to review this request.", you aren't one of that request's approvers; see [Approvals](/use/approvals/). ## Slack app or Slack webhook Slack can be reached two ways, and they don't depend on each other: | | Slack app (this page) | Slack webhook | |---|---|---| | Set up in | **Integrations** → **Slack** | Workspace settings → **Integrations** → **Webhook** | | Approve or reject from Slack | Yes | No | | Direct messages and mentions | Yes | No | | Work session threads | Yes | No | | Channels | One channel for the workspace | One channel per webhook URL | Choose the app to work with approvals in Slack. A webhook only forwards notification events to a channel; see [Webhooks](/integrate/webhooks/) and [Webhook setup](/integrate/webhooks/#create-a-webhook). ## Related docs - [Notifications & webhooks](/use/settings/notifications/) - [Reviewing requests](/use/approvals/reviewing/) - [Approvals](/use/approvals/) - [Monitor server status](/use/servers/monitor/) - [Plans & billing](/use/workspace/plans-billing/) Source: https://docs.alpacax.com/integrate/slack/