Slack API · error code

Slack error invalid_code: OAuth authorization code is invalid

Permanent - do not retryHTTP 200Tokens & authentication

Last verified against Slack API reference - chat.postMessage errors

What Slack returns
Value passed for code was invalid.

What error invalid_code means

The temporary authorization code you sent to oauth.v2.access could not be exchanged for a token. The method says "Value passed for code was invalid." This is the last step of installing your app, so when it fails the install fails and no token is saved.

Slack's OAuth guide gives the key limit: the code is "your temporary authorization code, which expires after ten minutes." Codes are also meant to be exchanged once. In practice, this error comes from a redirect handler that runs twice (a browser refresh, a prefetch, a retry after a timeout), from a slow handler or queue that exchanges the code too late, or from a code that was cut off or not URL-decoded when read from the query string.

It also shows up when the code is exchanged with the wrong app's credentials, for example a staging client_id with a code issued to the production app.

What it looks like

POST /api/oauth.v2.access
code=1234&client_id=...&client_secret=...

{"ok": false, "error": "invalid_code"}

Why it happens

  • The code was exchanged more than ten minutes after Slack issued it.
  • The redirect handler ran twice and the second exchange reused the code.
  • The code was read from the wrong query parameter or was truncated.
  • The code was exchanged with a different app's client_id and client_secret.

How to fix Slack error invalid_code

  1. 1Exchange the code right away in the redirect handler, before any slow work.
  2. 2Make the handler idempotent: if a token was already stored for this flow, do not exchange again.
  3. 3Read code from the query string and pass it through unchanged.
  4. 4Make sure client_id and client_secret belong to the same app that issued the authorize URL.
  5. 5Have the user restart the install to get a fresh code.

How to stop it recurring

Keep the OAuth callback fast and single-shot: exchange the code first, store the result keyed by the state value, then redirect the user away so a refresh cannot replay the code. Keep separate Slack apps and credentials per environment. Log failed exchanges with their timing to see whether expiry or replay is the cause.

Official reference: Slack API reference - chat.postMessage errors. See all Slack error codes or the Slack limits and quotas.

Related codes

Error invalid_code - quick answers

What does Slack error invalid_code mean?

The temporary authorization code you sent to oauth.v2.access could not be exchanged for a token. The method says "Value passed for code was invalid." This is the last step of installing your app, so when it fails the install fails and no token is saved. Slack's OAuth guide gives the key limit: the code is "your temporary authorization code, which expires after ten minutes." Codes are also meant to be exchanged once.

How do I fix Slack error invalid_code?

1. Exchange the code right away in the redirect handler, before any slow work. 2. Make the handler idempotent: if a token was already stored for this flow, do not exchange again. 3. Read code from the query string and pass it through unchanged. 4. Make sure client_id and client_secret belong to the same app that issued the authorize URL. 5. Have the user restart the install to get a fresh code.

Should I retry after error invalid_code?

No. Retrying the same request produces the same error; the condition has to be fixed first. Treat it as a permanent failure for that message and surface it, rather than looping.

Stop debugging Slack by hand

Connect the channel through Conferbot: tokens, webhooks and retries are handled, failures show as readable status.