Slack error invalid_auth: Authentication cannot be validated

Slack received a token but could not validate the authentication, and its documented description names the two branches explicitly: "Either the provided token is invalid or the request originates from an IP address disallowed from making the request." Most developers only ever consider the first branch, which is why the second one — IP allowlisting — produces the confusing cases where the same token works from a laptop and fails from production.

On the token branch, "invalid" means the string itself does not resolve to a live credential. Common shapes: the token was truncated or gained whitespace when pasted into a secrets manager; it belongs to a different app or a different workspace than the one you are calling about; it is the wrong kind of token entirely, such as an xapp- app-level token (valid only for Socket Mode and app-level connections) sent to a Web API method that needs an xoxb- bot token; or it is a stale value from an earlier install that has since been superseded. A token that was valid and was then explicitly killed usually returns token_revoked instead, but the boundary is not something to rely on — treat invalid_auth on a previously working integration as "re-check the whole credential path".

On the IP branch, an Org or workspace admin can restrict where API requests for an app may originate. When your traffic leaves from an address outside that allowlist — a new NAT gateway after an infrastructure change, a different egress IP per serverless invocation, a CI runner — Slack answers invalid_auth even though the token is perfectly good. The error string gives you no hint which branch you are on, so the diagnostic below separates them deliberately.

In the official SDKs this surfaces like any other platform error: Node's @slack/web-api rejects with error.code === ErrorCode.PlatformError and the body in error.data; Python's slack_sdk raises SlackApiError with e.response["error"] == "invalid_auth". Neither retries it, because retrying an authentication failure cannot succeed.

{"ok": false, "error": "invalid_auth"}

Validate credentials at boot with auth.test and log the resolved team and bot_id, which catches wrong-workspace tokens immediately. Keep staging and production apps as separate Slack apps with separate tokens so a cross-environment paste is impossible to miss. When infrastructure changes your egress IPs, treat Slack IP allowlists as part of the migration checklist. A broader walkthrough is in Slack bot not responding.