Slack error not_authed: No authentication token provided
Last verified against Slack API reference - chat.postMessage errors
No authentication token provided.What error not_authed means
The request reached Slack without any token at all. Slack is not rejecting your credentials — it never saw credentials. Every Web API method that touches workspace data requires a token, normally sent as an Authorization: Bearer xoxb-... header, and this error means that header (or the legacy token form field) was absent or empty by the time the request left your process.
This is almost always an environment problem rather than a Slack problem. The classic sequence: code reads process.env.SLACK_BOT_TOKEN, the variable is unset in the deployment environment (set locally in .env, never configured in production), the SDK is constructed with undefined, and every call fails with not_authed. Because the response still arrives with HTTP 200, health checks that only watch status codes miss it entirely.
Distinguish it from its neighbors: invalid_auth means a token was sent but could not be validated; token_revoked means the token was once valid and no longer is. not_authed is strictly "nothing was sent", which conveniently narrows the search to the code path that attaches the header.
What it looks like
{"ok": false, "error": "not_authed"}Why it happens
- The environment variable holding the token is unset or empty in the environment the code actually runs in (production vs. local .env).
- The SDK client was constructed before the environment was loaded (e.g. before dotenv.config() ran), capturing undefined.
- The Authorization header is stripped by a proxy, API gateway, or serverless layer between your code and api.slack.com.
- A raw HTTP call sends the token in the wrong place — JSON body instead of the Authorization header or form field.
- A refactor renamed the variable (SLACK_TOKEN vs SLACK_BOT_TOKEN) in code but not in the deployment config.
How to fix Slack error not_authed
- 1Log the first 10 characters of the token at client construction time; an empty or undefined value confirms the diagnosis instantly.
- 2Verify the variable exists in the runtime environment itself (container, function configuration, CI secret), not just in your local shell.
- 3Ensure environment loading (dotenv or equivalent) runs before the Slack client is instantiated.
- 4Call auth.test with the same token via curl -H "Authorization: Bearer $TOKEN"; if that works, the problem is in how your app attaches the header.
- 5If a proxy sits in front of outbound traffic, confirm it forwards the Authorization header unmodified.
How to stop it recurring
Fail fast at startup: assert the token is present and matches the expected xoxb-/xoxp- prefix before serving traffic, and make a successful auth.test part of the boot sequence or health check. That converts a silent per-request failure into a loud deploy-time one. Keep one canonical environment variable name across environments.
Official reference: Slack API reference - chat.postMessage errors. See all Slack error codes or the Slack limits and quotas.
Related codes
- invalid_auth: Authentication cannot be validatedSome aspect of authentication cannot be validated. Either the provided token…
- token_revoked: Token has been revokedAuthentication token is for a deleted user or workspace or the app has been…
- token_expired: Token has expiredAuthentication token has expired
- account_inactive: Token for a deleted user or workspaceAuthentication token is for a deleted user or workspace when using a bot token.
Error not_authed - quick answers
What does Slack error not_authed mean?
The request reached Slack without any token at all. Slack is not rejecting your credentials — it never saw credentials. Every Web API method that touches workspace data requires a token, normally sent as an Authorization: Bearer xoxb-... header, and this error means that header (or the legacy token form field) was absent or empty by the time the request left your process.
How do I fix Slack error not_authed?
1. Log the first 10 characters of the token at client construction time; an empty or undefined value confirms the diagnosis instantly. 2. Verify the variable exists in the runtime environment itself (container, function configuration, CI secret), not just in your local shell. 3. Ensure environment loading (dotenv or equivalent) runs before the Slack client is instantiated. 4. Call auth.test with the same token via curl -H "Authorization: Bearer $TOKEN"; if that works, the…
Stop debugging Slack by hand
Connect the channel through Conferbot: tokens, webhooks and retries are handled, failures show as readable status.