nullcipher

Slack tokens (xoxb-, xoxp-, xoxa-, xoxr-)

xoxb- (bot), xoxp- (user), xoxa- or xoxr- followed by dash-separated number and secret groups. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Slack token

What an AI chat would receive after masking

[SLACK_TOKEN_1]

1 × Slack token found and masked.

How nullcipher recognises it

xoxb- (bot), xoxp- (user), xoxa- or xoxr- followed by the dash-separated number and secret groups.

This is the rule text of the “Slack token” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

xoxb-0000000000-0000000000000-EXAMPLEexampleEXAMPLE

nullcipher replaces it with [SLACK_TOKEN_1]. The number groups are zeros and the secret part spells EXAMPLE. Slack never issued it.

Why it matters in an AI chat

Slack's documentation says bot token strings begin with xoxb- and user token strings with xoxp-. Whoever holds one can call the Slack API as that bot or that user, with the scopes the token was granted.

Depending on those scopes that can mean reading channel history, posting messages that look like they come from your bot or from you, and listing the people in the workspace.

Tokens reach AI chats inside pasted bot code, webhook handlers and error logs that print request headers.

If it already leaked

  1. Revoke the token with Slack's auth.revoke API method, called with the leaked token itself as the token argument. Slack's docs say the token should be passed as an HTTP Authorization header or as a POST parameter. [1]
  2. Do not set test=1 when you call it: Slack documents that as a testing mode in which the token is not actually revoked. [1]
  3. Get a replacement token by installing the app again through Slack's OAuth flow; the same guide notes that API access tokens are revoked via auth.revoke. [2]

Sources

  1. auth.revoke method — Slack Developer Docs — checked 2026-09-23.
  2. Installing via OAuth authorization code flow — Slack Developer Docs — checked 2026-09-23.
  3. Tokens — Slack Developer Docs — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.