Slack integration
Your team's 2FA codes in Slack
Type /otp in Slack and get the shared account's 2FA code, visible only to you. Encrypted secrets, per-channel restrictions and an access log.
In many teams, the request for a code already happens in Slack: “does anyone have the GitHub code?”. With the Share Auth integration, the answer no longer depends on whoever holds the phone.
What the command does
/otp githubreturns the account’s current code, the time it has left and the next code, with a button to get a fresh one./otp-listshows the accounts available in this channel, each with its own button, so you do not need to remember names./helplists the commands.
The name does not have to be exact. /otp github prod finds “GitHub
Production” from words in the name, the issuer or the description, and if
several accounts match, Slack offers you the candidates.
Replies are ephemeral: only the person who typed the command sees them.
Who can get what
An integration opens access to the whole connected Slack workspace. Slack proves which workspace the command comes from, not which Share Auth account is running it, so team roles do not apply here. Three safeguards take their place:
- per-channel restrictions, which limit each channel to the secrets it is
allowed to obtain:
#financesees Stripe,#opssees AWS; - the access log, where every code handed out appears with the name sent by Slack and the time (the channel is recorded in the integration’s activity);
- a per-person command limit, to stop bursts of requests.
Only the team owner can create, edit or disable the integration. Every call is checked against Slack’s signature: a request that does not come from your workspace is refused.
Setting up the integration
- In Share Auth, open Integrations and choose Slack under One-click connection.
- Slack asks you to authorise the Share Auth app in your workspace. The integration is created right away, with no credential to copy.
- Optional: turn on per-channel restrictions and link the secrets.
Prefer your own Slack app? Manual setup is still available: the page tells you where to find the bot token and the signing secret, and gives you the webhook URL to paste into your app, for both commands and buttons.
The integration’s page then shows its recent activity, refused commands included.
Frequently asked questions
No. The reply is ephemeral: only the person who typed the command sees it, and it disappears when Slack reloads.
No. Anyone in the connected workspace can run the command, which is exactly why per-channel restrictions exist. The access log records the name Slack sends.
Chat integrations are included in the Team and Business plans. An integration you created stays visible after moving to Free, but its commands are refused.
Yes. The owner disables the integration in one click from Share Auth, without deleting it, and turns it back on whenever they like.