Slack error not_allowed_token_type: Wrong class of token for this method
Last verified against Slack API reference - chat.postMessage errors
The token type used in this request is not allowed.What error not_allowed_token_type means
The method you called does not accept the kind of token you sent, no matter which scopes it carries. Slack's description: "The token type used in this request is not allowed." Slack has several token classes — bot tokens (xoxb-), user tokens (xoxp-), app-level tokens (xapp-), plus legacy and admin variants — and each Web API method declares which classes it supports at the top of its reference page.
The most frequent collision in bot development: using an xapp- app-level token (whose only jobs are Socket Mode connections and a handful of app-level methods) against ordinary Web API methods like chat.postMessage. The second most frequent: calling an admin-only method (admin.*) with a plain bot token, or a method that requires a user context with a bot token. In every case the scope list is irrelevant — the gate is the token class itself, which is why the error is distinct from missing_scope.
The fix is to look up the "Token types" line on the method's documentation page and supply a token of a supported class. If your app holds several tokens, this error usually means a wiring bug: the wrong credential is bound to the client making this family of calls.
What it looks like
{"ok": false, "error": "not_allowed_token_type"}Why it happens
- An app-level xapp- token was used on a regular Web API method; it is only valid for Socket Mode and app-level endpoints.
- A bot token was used on a method that only supports user tokens (or vice versa).
- An admin.* method was called with a non-admin token class.
- Multiple tokens are configured and the client for this call path was constructed with the wrong one.
How to fix Slack error not_allowed_token_type
- 1Open the method's reference page and read its supported token types.
- 2Check the prefix of the token being sent (xoxb-, xoxp-, xapp-) at the call site and match it to that list.
- 3Bind the correct token: bot token for standard bot operations, user token where the method demands user context, xapp- only for Socket Mode.
- 4If separate clients exist per token, add an assertion or naming convention so the wrong client cannot be injected silently.
How to stop it recurring
Name variables and secrets after the token class (SLACK_BOT_TOKEN, SLACK_APP_TOKEN) and validate prefixes at startup — an xapp- value in the bot-token slot should fail the boot check, not the first API call. Keep one client instance per token class and pass clients, not raw strings, through your code.
Official reference: Slack API reference - chat.postMessage errors. See all Slack error codes or the Slack limits and quotas.
Related codes
- missing_scope: Token lacks a required OAuth scopeThe token used is not granted the specific scope permissions required to…
- invalid_auth: Authentication cannot be validatedSome aspect of authentication cannot be validated. Either the provided token…
- no_permission: Token lacks permission in this contextThe workspace token used in this request does not have the permissions…
Error not_allowed_token_type - quick answers
What does Slack error not_allowed_token_type mean?
The method you called does not accept the kind of token you sent, no matter which scopes it carries. Slack's description: "The token type used in this request is not allowed." Slack has several token classes — bot tokens ( xoxb- ), user tokens ( xoxp- ), app-level tokens ( xapp- ), plus legacy and admin variants — and each Web API method declares which classes it supports at the top of its reference page.
How do I fix Slack error not_allowed_token_type?
1. Open the method's reference page and read its supported token types. 2. Check the prefix of the token being sent (xoxb-, xoxp-, xapp-) at the call site and match it to that list. 3. Bind the correct token: bot token for standard bot operations, user token where the method demands user context, xapp- only for Socket Mode. 4. If separate clients exist per token, add an assertion or naming convention so the wrong client cannot be injected silently.
Stop debugging Slack by hand
Connect the channel through Conferbot: tokens, webhooks and retries are handled, failures show as readable status.