Slack API "invalid_auth" (bad bot token) error in CI

By Kaveh Alemi·Latchkey

Slack returns error:"invalid_auth" when the token presented in the Authorization header is not a valid, active token. In CI this usually means the SLACK_BOT_TOKEN secret is empty, was rotated, or was pasted with a trailing space or newline.

What this error means

Any Slack Web API call (chat.postMessage, auth.test) responds HTTP 200 with {"ok":false,"error":"invalid_auth"}. It fails identically on every run once the token is bad.

{"ok":false,"error":"invalid_auth"}

Common causes

The secret is empty or not exposed to the step

The token was never set, or the step reads from a secret name that does not exist, so an empty Authorization header is sent.

The token was rotated or revoked

Reinstalling the app or rotating tokens invalidates the old xoxb- token; the stored secret still holds the dead value.

How to fix it

Verify the token with auth.test

1. Call auth.test to confirm the token is live before debugging the post.
2. If it returns invalid_auth, regenerate the bot token from the app OAuth page.
3. Update the secret, taking care not to include a trailing newline.

curl -sS https://slack.com/api/auth.test \
  -H "Authorization: Bearer $SLACK_BOT_TOKEN"

Reference the secret correctly in the workflow

Pass the token through the step env from the exact secret name defined in the repository or organization.

- name: Notify Slack
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
  run: ./scripts/notify.sh

How to prevent it

• Run auth.test as the first Slack step so a bad token fails fast.
• Rotate the token and the secret together in one change.
• Strip whitespace when storing the token secret.

Frequently asked questions

Related guides

References

• GitHub Actions documentation