Skip to main content

Managing organization-ready apps

Welcome to the new home of Slack developer docs!

We're still building and not all features are available quite yet. Enjoy this peek into the future!

Not ready for the future? Return to the past at api.slack.com.

For administrators, you may be wondering about what makes apps organization-ready, and when they need to be. Read on for more information.

Benefits of org-ready apps​

First, let's take a look at some of the benefits for users within your Enterprise Grid organization:

  • Org Admins (that's you!) will be able to distribute apps easily across all workspaces, or restrict access to certain workspaces.
  • Pre-approved apps can be automatically installed when a workspace is created.
  • Users only have to authenticate with an app once for all workspaces that have access to the app.

Organization-ready apps are installed once at the organization level, but an organization-ready app isn't automatically added to the workspaces in an organization, nor does it enjoy any additional privileges by being installed at the organization level. Read more about this nuance below. The app has a single token that represents the permissions for the app on multiple workspaces, and is authorized once for an entire organization using an OAuth flow. Org Admins can then add it to workspaces in the organization without further authorization.

Sometimes apps are required to be organization-ready:

In the latter case, the apps are Slack-hosted, so we take care of the heavy lifting for you— but for the former case, read on to learn what actions need to be taken to ensure that apps with custom steps are available for use in Workflow Builder.

Preparing apps for Enterprise Grid​

There are a few ways an app can be installed within an Enterprise Grid organization:

  1. On a workspace within an Enterprise organization. This type of installation is only available for a Slack app that does not contain a custom step intended for use in Workflow Builder (the only option for this case would be organization-wide installation). Similarly, workflow automations cannot be installed in this way.
  2. Org-ready apps installed on the organization level can be granted access for some or all of the workspaces in that Enterprise Grid organization. This is the only installation option compatible with custom steps intended for use in Workflow Builder.
  3. An app can be installed at an organization level. This is a specific type of app; usually an admin or Data Loss Prevention (DLP) type app.

Now, if an app is installed by one or more Enterprise Grid workspaces, or a workspace the app is already installed on becomes part of an Enterprise Grid organization's workspace:

  • The app may not know what to do with messages and users originating from shared channels.
  • The app may have trouble dealing with object IDs beginning with atypical characters, such as user IDs starting with W.
  • The bot could blindly reply multiple times to messages, not recognizing a unique message delivery scenario introduced by shared channels.
  • Workspaces on Enterprise Grid are often large and some API responses, such as channel memberships, can grow immense. The app may need to change how it digests this information.

You never know when a specific workspace on Enterprise Grid will install the app. Without making a few tweaks, new users may notice these quirks in the app's behavior. Although apps that are installed on an Enterprise organization look similar to apps installed on a single workspace, there are a few changes to be aware of before apps can be deployed across an organization.

Installing organization-ready apps​

When you install an app across the entire organization, it is not added to any workspaces in the organization. You must do this later, but you can add the app to several workspaces at once.

Organization-ready apps can be installed in the following ways:

Apps installed via app settings will generate the organization-wide token automatically, whereas apps installed via OAuth will require a handshake to succeed in order to programmatically generate the token. Both installation methods provide the token the app will use to interact with the Slack platform APIs. Regardless of how the app is installed, the organization-wide token behaves the same.

Choosing which workspaces the app is in​

Apps installed at the organization level and granted to one or more workspaces in the organization do not have any additional privileges compared to an app installed at the workspace level alone. Organization-ready apps do not need to be granted to all workspaces, and they in fact are not added to any automatically when they are org-installed. Org Admins can determine to which workspaces the app is granted from the admin dashboard. The advantages of installing at the organization level are as follows:

The restrictions defined by which workspaces the app is added to carry through to which users will have access to the app's custom steps in Workflow Builder.

For example, say you have an Enterprise Grid organization called Fiber Arts. Fiber Arts has three workspaces: Knitting, Crochet, and Embroidery. If the organization-ready app, StitchFix, is shared only with workspaces Knitting and Crochet, then users in Embroidery cannot access it or any custom steps belonging to it. Further, any workflows built using the custom steps from StitchFix cannot be accessed or used by users in Embroidery.

Next steps​

✨ Read more about automating app approvals in Enterprise Grid.