> ## Documentation Index > Fetch the complete documentation index at: https://docs.puntego.com/llms.txt > Use this file to discover all available pages before exploring further. # Slack reviews and delivery > Deliver operational events and let explicitly mapped reviewers act from Slack without bypassing Puntego authorization. Puntego connects one workspace-selected Slack channel to the product's feedback, Inbox, and governed-action review loops. **Connect with Slack** is the recommended mode. A manual Incoming Webhook remains available under Advanced for teams that need outbound-only delivery. ## What the OAuth connection supports * Helpful and unhelpful answer ratings, including bounded reviewer context. * A signed **Suggest correction** modal that records scrubbed unhelpful feedback and creates an Owner/Admin-approved Knowledge draft; it never auto-publishes. * A signed **Translate** modal that privately translates the review on demand for the mapped reviewer while preserving the original question and answer. * New or recurring Inbox issues, with Resolve and Snooze actions. * Governed-action approval requests, with Approve and Deny actions. * A queued test plus delivery health, provider error codes, and last successful test/delivery timestamps. Interactive controls appear only for an OAuth bot connection. A Slack member must be explicitly mapped to a current Puntego workspace member before a click is accepted. Puntego rechecks that membership and role when the durable job runs; approval still requires a live Owner or Admin role. Action inputs, credentials, and customer records are never included in the Slack message. Correction submissions are digest-idempotent durable jobs. Feedback, the Needs Attention occurrence, the approval-required draft, and the correction receipt commit atomically, so a reclaimed job does not duplicate work or overwrite a newer correction. Translation additionally requires a configured workspace model provider and available AI budget. Puntego revalidates membership, the exact Slack installation/channel, and the bot credential before calling the model, then revalidates at delivery. The generated text is not persisted and is delivered only through Slack `chat.postEphemeral` to the mapped reviewer. There is no public-message fallback; ambiguous delivery is never automatically resent. ## Connect a workspace 1. Open **Integrations → Slack** and choose **Connect with Slack**. 2. Review the requested `chat:write` and `incoming-webhook` scopes. 3. Select the Slack workspace and channel, then finish authorization. 4. Map each allowed Slack member ID to a current Puntego member. 5. Select event families, save, and queue a test. Changing to another Slack team removes existing reviewer mappings. Pausing the connection stops both delivery and interaction processing. Removing it deletes encrypted credentials and reviewer mappings, cancels pending work, and scrubs retained delivery payloads. ## Security and delivery contract * OAuth state is single-use, expires after ten minutes, and is bound to the exact Puntego tenant, user, and dashboard session. Authorization codes are exchanged once and are never stored or retried after an ambiguous failure. * Bot tokens and Incoming Webhook URLs are stored as tenant-bound ciphertext; only non-secret workspace, channel, health, and URL-hint metadata is returned. * Slack requests are verified against the raw request body with the signing secret, a constant-time HMAC comparison, and a five-minute timestamp window. * Button values are independently signed, tenant/team/integration/resource bound, short-lived, and size limited. The API acknowledges valid clicks quickly; mutations run later from a durable, idempotent, lease-fenced job. * Correction and translation modals carry separately signed private metadata bound to the callback, app, team, reviewer, channel, message, resource, and a ten-minute expiry. Exact callback and block/action IDs are required. * Membership and role are checked again during execution. A replay, expired approval, already-decided approval, or revoked reviewer cannot run an action twice. * Outbound event delivery uses a tenant-scoped durable outbox. Slack `429` responses honor `Retry-After`; an ambiguous network failure after dispatch begins is retained as `unknown_delivery_state` instead of risking a duplicate. * After a decision, Puntego replaces the original button row with the bounded result so a finished review no longer looks actionable. If Slack rejects that edit, Puntego falls back to a thread reply. This notification remains best-effort after the authoritative Puntego mutation; the dashboard is the source of truth if Slack cannot receive either update. * Terminal interaction jobs are purged after 90 days. Customer erasure scrubs attributable correction text, locale, resource linkage, and receipt IDs. ## Slack app configuration The hosted environment must configure all five values before OAuth and interactivity become available: * `SLACK_APP_ID` * `SLACK_CLIENT_ID` * `SLACK_CLIENT_SECRET` * `SLACK_SIGNING_SECRET` * `SLACK_OAUTH_REDIRECT_URI` Register the redirect URI exactly, enable Interactivity with `POST /api/slack/interactions`, enable Incoming Webhooks, and grant only `chat:write,incoming-webhook`. Puntego fails closed if the returned app ID, team, channel, bot token, or exact granted-scope set does not match the install contract. ## Advanced: manual Incoming Webhook Manual mode accepts only an HTTPS `hooks.slack.com` or `hooks.slack-gov.com` Incoming Webhook URL with Slack's exact path shape. It can deliver selected events and health diagnostics, but it cannot authenticate reviewers or process buttons. Saving a manual URL deliberately switches the workspace to this outbound-only mode. See Slack's official documentation for [OAuth installation](https://docs.slack.dev/authentication/installing-with-oauth/), [request verification](https://docs.slack.dev/authentication/verifying-requests-from-slack/), [interactive request handling](https://docs.slack.dev/interactivity/handling-user-interaction/), [`chat.update`](https://docs.slack.dev/reference/methods/chat.update/), and [`chat.postEphemeral`](https://docs.slack.dev/reference/methods/chat.postEphemeral/). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.