---
title: Enterprise-Managed Authorization for Slack with Okta
product: vercel
url: /docs/connect/ema/slack
canonical_url: "https://vercel.com/docs/connect/ema/slack"
last_updated: 2018-10-20
type: how-to
prerequisites:
  - /docs/connect/ema
  - /docs/connect
related:
  - /docs/connect/ema
summary: Configure Enterprise-Managed Authorization (EMA) with Okta and Slack so your app can access the Slack MCP server through Vercel Connect.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Enterprise-Managed Authorization for Slack with Okta

Use Enterprise-Managed Authorization (EMA) to access the Slack Model Context Protocol (MCP) server after Okta sign-in, without a separate Slack consent prompt. Enable EMA in Vercel Connect and Slack, and configure cross-app access (XAA) in Okta. See [how EMA uses XAA](/docs/connect/ema#ema-and-cross-app-access).

Slack requires an organization-level app installation for EMA. Enabling EMA on the Connect connector doesn't replace the Slack organization and app approvals below.

## Prerequisites

- A Slack organization with [EMA available](https://slack.com/help/articles/54548358406419-Manage-access-to-the-Slack-MCP-server-through-your-identity-provider) and SAML single sign-on (SSO) through Okta.
- A Slack org owner and Okta super admin to complete setup.
- An [identity provider (IdP) connector configured for EMA](/docs/connect/ema#configure-your-identity-provider), with an active Okta AI agent linked to its OpenID Connect (OIDC) application.

## Enable EMA for your Slack organization

1. Open Slack's **Organization settings**, then **Security** > **SSO settings**.
2. Edit **Enterprise-Managed Authorization** and enable it.
3. Set **ID-JAG Issuer URL** to your Okta org URL, such as `https://your-org.okta.com`, and save.

Use your organization's issuer, not the Slack MCP URL.

## Create and approve the Slack app

Create a Slack connector in Vercel Connect using managed setup. Enable **Enterprise-Managed Authorization (EMA)** in **Resource** mode. Connect enables organization deployment and EMA in the Slack app's manifest.

Choose only the user scopes your app needs, such as `users:read` and `users:read.email`.

If you supply an existing Slack app instead:

1. Add `https://connect.vercel.com/callback` to its OAuth redirect URLs.
2. Enable **Org-readiness** and **Enterprise-Managed Authorization** in the Slack app settings.
3. Add the required user scopes and the `team:read` bot scope.
4. Enter its OAuth client ID and client secret in the Slack connector.

Have a Slack administrator approve and install the app **at the organization level**, then add it to the required workspaces. Workspace-only installations don't support EMA. Keep its OAuth **client ID** for Okta.

For an existing connector, enable EMA **Resource** mode in **Settings** and save. Resolve any Slack configuration sync errors before testing.

## Connect the Okta agent to Slack

1. Open Slack's application integration in Okta. Under **Machine Assignments** > **Callers**, enable **Cross App Access (XAA)**. Older versions call this tab **Resource Server**.
2. Verify its **Issuer URL** is `https://mcp.slack.com`. Okta Integration Network apps may supply this automatically.
3. Go to **Directory** > **AI Agents**, select your agent, and open **Resource connections**.
4. Select **Add resource connection** and configure:

| Field | Value |
| --- | --- |
| Application instance | Your XAA-enabled Slack application integration |
| Agent client ID registered in Slack | The Slack app's OAuth client ID, not its app ID or the Okta client ID |
| Resource identifier | `https://mcp.slack.com` |
| Scopes | Allow only the user scopes your app requests |

Save the connection. See [Okta's AI agent-to-app guide](https://developer.okta.com/docs/guides/xaa-agent-to-app/main/#configure-the-xaa-connection) for the full workflow.

## Request a Slack token

Enable EMA **Identity Provider (IdP)** mode on the Okta connector and **Resource** mode on Slack. Link both connectors to your project and environment.

Slack defaults both **Audience** and **Resource** to `https://mcp.slack.com`, so leave them empty unless you need an override. Don't use your Okta org URL for these fields.

Follow the [Passport flow](/docs/connect/ema#use-ema-with-passport), then use the [resource token example](/docs/connect/ema#request-a-resource-token) with:

| Parameter | Example |
| --- | --- |
| Resource connector UID | `slack/enterprise` |
| `scopes` | `['users:read', 'users:read.email']` |

Replace the UID with yours and pass the Passport identity as `subject`.

For apps without Passport, follow the [custom integration flow](/docs/connect/ema#custom-integrations-without-passport). Set `subject.experimental_idp` to your Okta connector's UID, such as `oauth/okta`, and use the same application user ID as the IdP sign-in.

Use the returned token for server-side Slack MCP requests, not as a general-purpose bot token.

## Troubleshoot access

| Symptom | What to check |
| --- | --- |
| `app_not_admin_approved` | A Slack administrator must approve and install the app at the organization level. |
| `UserAuthorizationRequiredError` | Check the stored IdP refresh token, both connectors' EMA modes, project links, and Okta resource connection. Follow the [authorization recovery steps](/docs/connect/ema#handle-authorization-failures). |
| Scope-related errors | Match the scopes in your request, Slack app configuration, and Okta resource connection. |

## Reference documentation

- [Okta: Implement XAA token exchange](https://developer.okta.com/docs/guides/xaa-request-token-ex/openidconnect/main/)
- [Slack: Enterprise-managed authorization](https://docs.slack.dev/authentication/enterprise-managed-authorization/)


---

[View full sitemap](/docs/sitemap)


If you find anything wrong or missing or can't find something, submit feedback by reading https://vercel.com/feedback.md to improve Vercel.