--- title: How to test a Slack bot with your Vercel preview deployment description: Learn how to build and test a Slack bot using Vercel preview deployments. This guide covers setting up your Slack app, configuring webhook URLs, and bypassing deployment protection using the x-vercel-protection-bypass query parameter. url: /kb/guide/test-slack-bot-with-vercel-preview-deployment canonical_url: "https://vercel.com/kb/guide/test-slack-bot-with-vercel-preview-deployment" published: 2026-01-29 last_updated: 2026-07-11 authors: Ismael Rumzan related: - /docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation install_vercel_plugin: npx plugins add vercel/vercel-plugin --- ## Related pages > **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - [Bypass Deployment Protection](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection?from=related) — Learn how to bypass Deployment Protection for specific domains, or for all deployments in a project. - [Automated & Agent Access](https://vercel.com/docs/deployment-protection/automated-agent-access?from=related) — Grant AI agents, CI/CD pipelines, MCP servers, and testing tools access to Vercel deployments that have Deployment Prote - [vercel curl](https://vercel.com/docs/cli/curl?from=related) — Learn how to make HTTP requests to your Vercel deployments with automatic deployment protection bypass using the vercel - [Deployment Protection](https://vercel.com/docs/deployment-protection?from=related) — Learn how to control access to your Vercel project's preview and production URLs with Deployment Protection. Configure p - [Protect Deployments](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments?from=related) — Vercel offers several methods to protect your deployments: Vercel Authentication, Passport, Password Protection, and Tru - [Slack](https://v0.app/docs/slack?from=related) — Add v0 to your Slack workspace so your whole team can contribute to production. - [How to lock down deployments on Vercel and v0](https://vercel.com/kb/guide/locking-down-deployments?from=related) — Protect who can see your deployments. - [How to build a Slack bot with Next.js and Redis](https://vercel.com/kb/guide/how-to-build-a-slack-bot-with-next-js-and-redis?from=related) — This guide walks through building a Slack bot with Next.js, covering project setup, Slack app configuration, event handl - [Run and track deploys from Slack](https://vercel.com/kb/guide/run-and-track-deploys-from-slack?from=related) — Build a Slack deploy bot with Chat SDK and Vercel Workflows. Dispatch GitHub Actions from a slash command, gate producti - [Build your own Slackbot with Vercel Connect](https://vercel.com/kb/guide/build-a-slack-bot-with-vercel-connect?from=related) — Learn how to build your very own Slackbot with Chat SDK and AI SDK. Vercel Connect supplies runtime Slack tokens and for - [How can I run end-to-end tests after my Vercel Preview Deployment?](https://vercel.com/kb/guide/how-can-i-run-end-to-end-tests-after-my-vercel-preview-deployment?from=related) — Learn how to use the Vercel CLI in combination with your CI/CD provider to run end-to-end tests for every code change. Full cross-link map for this page: [/kb/guide/test-slack-bot-with-vercel-preview-deployment.graph.md](/kb/guide/test-slack-bot-with-vercel-preview-deployment.graph.md) When you deploy a Slack bot on Vercel, it needs to interact with Slack's webhook verification system. When you enable deployment protection, Slack cannot verify your webhook URL. This guide shows you how to bypass deployment protection so you can test your bot on preview deployments. ## Prerequisites - A Vercel account with a deployed project - A Slack workspace where you can create apps - Deployment protection enabled on your Vercel project ## Step 1: Create your Slack app 1. Go to [api.slack.com/apps](https://api.slack.com/apps) and create a new app 2. Choose "From scratch" and give your app a name 3. Select your development workspace ## Step 2: Clone and deploy the Slack agent template Use the [Slack Agent Template](https://vercel.com/templates/nitro/slack-agent-template) to get started quickly: 1. Clone the template repository 2. Deploy it to Vercel 3. Note your deployment URL ## Step 3: Get your protection bypass secret When you enable deployment protection, Vercel generates a secret you can use to bypass it: 1. Go to your project in the Vercel dashboard 2. Navigate to Settings > Deployment Protection 3. Under "Protection Bypass for Automation", copy the secret This secret is also available as the `VERCEL_AUTOMATION_BYPASS_SECRET` environment variable in your deployment. ## Step 4: Configure the Slack webhook URL This is the key step. Add the bypass secret as a query parameter to your webhook URL: `https://your-app.vercel.app/api/slack?x-vercel-protection-bypass=YOUR_SECRET` In your Slack app settings: 1. Go to Event Subscriptions 2. Enable events 3. Enter your Request URL with the bypass parameter included 4. Slack will verify the URL successfully ## Why this works Slack's URL verification sends a challenge request to your endpoint. Without the bypass secret, Vercel's deployment protection blocks this request. By adding `x-vercel-protection-bypass` as a query parameter, Vercel allows the request through. Slack includes this parameter in all subsequent webhook calls, so your bot works seamlessly. ## Alternative: Use a header If you have control over the HTTP headers, you can also bypass protection by setting the `x-vercel-protection-bypass` header. The query parameter approach works with services like Slack that do not allow custom headers. ## Security considerations Including the bypass secret as a query parameter introduces security risks you should be aware of: What gets exposed: - The secret is visible in the Slack app configuration UI to anyone with access - Query parameters appear in server logs, proxy logs, and monitoring tools - If screenshots of your Slack configuration are shared, the secret is visible Why this approach is necessary: Slack's Event Subscriptions do not support custom headers, so the query parameter approach is the only way to bypass deployment protection for webhook verification. ### How to use this safely: 1. **Rotate regularly** - The bypass secret is rotatable. Generate a new secret in your project settings regularly if you will be using the slack bot with preview deployments for an extended period 2. **Limit access to Slack configuration** - Restrict who can view and edit your Slack app configuration to minimize exposure. 3. **Use proper authentication in your app** - The bypass secret only bypasses deployment protection. Always implement proper authentication in your Slack bot code using Slack's [signing secret verification](https://api.slack.com/authentication/verifying-requests-from-slack). ### What the bypass secret protects: The bypass secret only allows requests to reach your preview deployment - it does not provide access to your application logic, database, or other resources. Your Slack bot should still verify that requests come from Slack using the signing secret. ## Local development For local development, use `vercel dev --tunnel` to expose your local server to Slack. This creates a public URL that Slack can reach. The Chat SDK implements middleware for switching between local and preview deployments. ## Additional resources - [Slack Agent Template](https://vercel.com/templates/nitro/slack-agent-template) - [Protection Bypass for Automation docs](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation)