Slack

Receive approval requests and server alerts in Slack, and respond to requests from a message.

Slack integration options#

Connecting Slack brings approval requests and server alerts into a Slack channel your team already watches, and lets approvers approve or reject a request from the message without opening the console.

This page covers the Slack app integration under Integrations. Posting notifications to Slack through an incoming webhook is a separate, simpler option; see Slack app or Slack webhook.

What Slack gets you#

• Approval requests in a channel. Each request is posted as a card with Approve and Reject buttons. A decision made in Slack counts the same as one made in the console, and the card then shows the result and who decided. Requests raised inside one work session share a thread; see Approving from Slack in a work session.
• Alerts in the same channel. Servers that go offline, metric alerts whose rule posts to Slack, and logins that reached a server without Alpacon are posted there too. Critical AI session analysis results are always posted. High results are posted only when the workspace doesn’t receive periodic reports. See Notifications & webhooks and Session risk analysis.
• Direct messages. A member whose Slack account is linked gets a direct message from the Alpacon app when another approver decides their request, and, when they can approve their own work session request, that request first. Members manage their Slack DMs in Notification preferences.

Some requests can’t be settled with a button, for example those that need MFA. Their card links to the console instead; see What a Slack card shows.

Who can connect Slack#

• Plan: Essentials or Enterprise. On the Free plan the Slack card under Integrations shows an upgrade prompt and the connection is refused. See Plans & billing.
• Role: a Superuser connects Slack, sets the channel, links members, and disconnects. Integrations is in the admin section of the left sidebar.
• One Slack workspace per Alpacon workspace. To move to a different Slack workspace, disconnect the current one first.

You also need to be allowed to install apps in the Slack workspace you connect.

Connect Slack#

Permissions the Slack app requests#

Slack asks you to approve these permissions when you connect the app. You can review the granted permissions later under Scopes on the Slack page.

Choose the channel#

The Notification channel card on the Overview tab sets the channel:

1. In Slack, find the channel’s ID (for example C0123ABCD) in the channel’s details.
2. Enter it in Default channel ID and click Save.

Once saved, the card shows the channel’s name next to the ID and the status Notifications on. To stop channel posts, clear the field and save; the status changes to Notifications off.

The Alpacon app can post to a public channel without being a member. For a private channel, invite the Alpacon app to the channel first.

One channel carries approval requests, server alerts, and direct-login alerts. Critical AI session analysis results are always posted there. High results are posted only when the workspace doesn’t receive periodic reports. See Session risk analysis. Cards show who asked for what, command lines, server names, and accounts, so keep the channel to your approvers and reviewers.

On the Free plan the channel can’t be changed, so a workspace that downgrades keeps the channel it had. Disconnecting still works on every plan.

To check the channel, ask another member to submit a work session request that waits for an approver, then look for its request card in Slack. A session you request for yourself is approved immediately and does not produce a request card. The connection page does not offer a test-notification button. If no card arrives, check When messages stop arriving.

Link members to Slack#

The buttons work only for a member whose Slack account is linked to their Alpacon account, and only linked members get direct messages and mentions.

When Slack is connected, every member whose Slack email matches their Alpacon email is linked automatically. Anyone who joins later, or whose emails differ, is linked by a Superuser:

1. Open the Users tab on the Slack page. It lists linked members, with Email match or Manual as the link’s method.
2. Click Link user, pick the Alpacon user and the Slack member, and save. Both lists show only accounts that aren’t linked yet, and only people in the connected Slack workspace can be linked.

Unlink in a row’s menu removes a link.

A channel card mentions people in two cases. When a request you could approve yourself reaches the other approvers, its card mentions those whose accounts are linked; see When you can approve your own work session request. In a work session thread, replies mention the approvers who approved the session or one of its requests that was posted to the channel; see Approving from Slack in a work session.

What a Slack card shows#

An approval card leads with a headline naming the requester, and the AI agent when there is one, and what they ask for. Below it:

• Except for session extensions, Type and Submitted, the time the request was made, with its UTC offset.
• What the request is for: an account or group name, a token name, a work session’s title, or a held command’s whole command line.
• For a held command, its Risk level and, when it runs with sudo, Privilege. See Held commands that run sudo.
• For a held command, Origin and Session, described below.
• For a work session, Target account, the account the session runs as.
• The requester’s description, the reason the request needs approval with a link to your Access rules, and the name of the Alpacon workspace it came from.

A session-extension card shows Expiry (the current and requested end, with the added time, such as 21:32 → 23:32 UTC-7 (+2 h)) and Target servers (the first five, then +N more). It has no Type or Submitted fields. It keeps the requester headline, description, approval reason, and buttons, and shows Origin for a token request. The decision deadline, assignee, original approval, and extension count are in the console only.

Origin and session#

A held command’s card says where the command came from:

• Origin names the token the command ran with: API token deploy-bot (jane) for an API token, with the person it belongs to, or Service token ci-runner (app release-bot) for a service token, with its application. A command run interactively, without a token, has no Origin field.
• Session names the work session the command ran in, and who opened it, for example Patch web servers (opened by jane). No work session means the command ran outside any work session, which a token can do. Read that as a sign to check the command more closely.

Both stay on the card after the request is decided.

The buttons#

• Approve and Reject settle the request directly.
• A single button that opens the console replaces them when the decision has to be made there: a request that needs MFA, a command too long to show in full, or a request that runs a script. The card says which. See When a decision asks for MFA.
• Only Reject is offered when the request can’t be approved, for example because the sudo policies changed after it was made. The card says why.

When a request needs more than one approval, clicking Approve records your vote, and only you see “Vote recorded (1/2 approvals).” The card keeps its buttons until the request is decided. Once it is, from Slack or the console, the card changes to the result and who decided it. A click on a card whose request is already decided answers “This request has already been reviewed.”

If you made the request, another approver decided it, and your Slack account is linked, you also get a direct message with the decision. A request you decide yourself sends you none.

Disconnect Slack#

On the Overview tab, click Disconnect and type the Slack workspace’s name to confirm. Disconnecting stops every post and direct message from the Alpacon app, removes the Alpacon app from your Slack workspace, removes the channel setting and every member link, and removes Slack as an approval channel. Requests can still be decided in the console, and a Slack webhook keeps posting.

Connecting again starts over: set the channel again, and link by hand anyone the email match doesn’t cover.

When messages stop arriving#

Check these in order:

• The channel is set. If the Notification channel card shows Notifications off, no channel is set and nothing is posted to one.
• The app can post to the channel. For a private channel, invite the Alpacon app to it. If a public channel still gets nothing, invite the app there too.
• The Alpacon app is still installed in Slack. If someone removed the app on the Slack side, Alpacon still shows Slack as connected but nothing arrives. Click Disconnect, then Connect Slack again.
• The alert is one that posts to Slack. A metric alert posts only when its rule’s Slack channel post is on and its severity allows it; see What a rule can carry. Some notifications are never posted to Slack; see Notifications & webhooks.
• Your direct messages are on. A missing DM can mean your Slack account isn’t linked, or Slack DM is off in your notification preferences. No decision DM comes for a request you decided yourself.

If a button answers “This Slack account isn’t linked to Alpacon. Ask an admin to link it.”, ask a Superuser to link your account. If it answers “You are not authorized to review this request.”, you aren’t one of that request’s approvers; see Approvals.

Slack app or Slack webhook#

Slack can be reached two ways, and they don’t depend on each other:

Choose the app to work with approvals in Slack. A webhook only forwards notification events to a channel; see Webhooks and Webhook setup.

Related docs#

• Notifications & webhooks
• Reviewing requests
• Approvals
• Monitor server status
• Plans & billing