Before you start
The token created is a workspace token, not a personal one: a workspace admin authorizes the app once, for everyone.
Public channels are ingested as soon as the workspace is connected. For a private channel, plan on a second gesture after authorizing: inviting it, one channel at a time (next section).
Including a private channel
This is a two-step gesture: the opt-in below, then inviting the bot into the channel from Slack. Today, the opt-in happens on the command line, including for a managed workspace - the console has no dedicated screen for this fine-grained setting yet:
Then invite the bot into that channel from the channel's settings, in Slack. To reverse it, opt-out-private <channel> takes the channel out of scope at the next cleanup.
What gets synced
The workspace's public channels, plus any private channel explicitly included; the whole thread (root message and replies) is the unit ingested. Direct messages are never read: the permission that would expose them is not even requested.
90-day default window at first sync, like other sources (self-host: connectors.slack.history_days). A deleted message or a channel that leaves scope is reconciled on the next pass.
Check the status
Managed: the Slack card in your Sources shows the connected workspace. Self-host:
Remove it
| You want to | The gesture |
|---|---|
| Remove one private channel, keep the rest of the workspace connected | kastel connector slack opt-out-private <channel> (removed at the next cleanup) |
| Remove the whole workspace, keep what was ingested | "Disconnect" (console), or kastel connector slack offboard <workspace> |
| Actually delete what was ingested | kastel erase --connector slack or the /erasures review |