slack-mcp-server: Skill for Claude Code

Slack Token Refresh

Why tokens expire

The Slack MCP server uses browser session tokens (not OAuth tokens):

• xoxc — the main API token, extracted from POST request bodies
• xoxd — the session cookie (d cookie), required alongside xoxc

These are tied to a browser session. They expire when:

• The browser session ends or the user logs out
• Slack invalidates the session (security policy, password change, etc.)
• The session cookie expires naturally

Automated refresh flow

Use the Chrome DevTools MCP to extract fresh tokens without manual browser interaction.

Step 1 — Open Slack in Chrome

Use mcp__chrome-devtools__new_page to open https://skyscanner.slack.com
Wait for the page to fully load (wait_for "Slack")

Step 2 — Intercept a network request to extract xoxc

Slack POSTs to its API on every action. Trigger one by navigating or clicking:

Use mcp__chrome-devtools__navigate_page to reload the page
Use mcp__chrome-devtools__list_network_requests to find POST requests to slack.com/api/
Find a request with a body containing "token=xoxc-"
Use mcp__chrome-devtools__get_network_request with the reqid to get the full body
Extract the token value: everything from "xoxc-" up to the next "&" or end of string

Alternatively, check the request headers for the Authorization: Bearer xoxc-... header.

Step 3 — Extract xoxd from cookies

Use mcp__chrome-devtools__evaluate_script with:
  () => document.cookie
Look for the "d=" cookie value — this is the xoxd token (starts with "xoxd-")

OR use:
  () => {
    return document.cookie.split(';')
      .map(c => c.trim())
      .find(c => c.startsWith('d='))
      ?.replace('d=', '') || 'not found'
  }

If document.cookie doesn't show the d cookie (HttpOnly), check the network request headers instead: look for Cookie: d=xoxd-... in any POST request to slack.com.

Step 4 — Update macOS Keychain

Run these two commands (replace values with the freshly extracted tokens):