npm / @slack/oauth
@slack/oauth
What changed in @slack/oauth 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
38 breaking6 new APIs and options1 behavior and defaults1 tooling1 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@slack/oauth 438 changes
Breaking changes 31
On platform errors, callbacks no longer receive the platform response as their second argument; it is available as the first error argument's data property.
The CLIENT_EVENTS constant was removed; use simple strings for event names.
This InstallProvider client option is no longer available; use clientOptions.fetch with a custom fetch implementation instead.
This InstallProvider client option is no longer available; configure TLS via clientOptions.fetch or the NODE_EXTRA_CA_CERTS environment variable.
The duplicate dm method family was removed; use the corresponding methods under im.
error.name now reflects the specific class name instead of the generic 'Error'; update checks that branch on error.name.
The incoming webhook option iconEmoji was renamed to icon_emoji.
The incoming webhook option iconUrl was renamed to icon_url.
The incoming webhook option linkNames was renamed to link_names.
The incoming webhook option unfurlLinks was renamed to unfurl_links.
The incoming webhook option unfurlMedia was renamed to unfurl_media.
The duplicate mpdm method family was removed; use the corresponding methods under mpim.
Node.js 18 support is dropped; the minimum supported Node.js version is now 20.
The retry policy dictionary is now exported as retryPolicies, replacing RETRY_POLICIES.
The RTM_EVENTS constant was removed; subscribe directly to event names as strings.
The RTM_MESSAGE_SUBTYPES constant was removed.
The top-level export name changed from RtmClient to RTMClient.
The dataStore constructor option and the datastore types and APIs were removed.
The ws_close event is no longer emitted; the underlying websocket state is considered private.
The ws_opened event is no longer emitted; the underlying websocket state is considered private.
The ws_opening event is no longer emitted; the underlying websocket state is considered private.
serverPongTimeout replaces the maxPongInterval option.
The constructor option was renamed from slackAPIUrl to slackApiUrl for improved readability.
The socketFn constructor option was removed; use agent for proxy support or tls for custom TLS configuration.
useRtmConnect now defaults to true; the notes recommend querying for additional data with a WebClient after connection.
reconnect was removed; the guide substitutes disconnect, waiting for the disconnected event, and then calling start with the saved options.
send was repurposed; in most cases use addOutgoingEvent(awaitReply, type, body), whose returned Promise reports message acknowledgement.
updateMessage was removed from RTMClient; use WebClient.chat.update instead.
Methods no longer accept positional arguments; each takes one object argument with method-specific required and optional properties.
The constructor option was renamed from slackAPIUrl to slackApiUrl for improved readability.
The transport constructor option was removed; use agent for proxy support or tls for custom TLS configuration.
New APIs and options 6
Applications need to install this additional package to pass WebClient or RTMClient outgoing requests through an HTTP proxy.
clientPingTimeout replaces the wsPingInterval option.
RTMClient now exposes more well-defined states and substates through events, including disconnected, connecting, connected, ready, disconnecting, and reconnecting.
A new abstract base class lets you catch any error thrown by this package with an instanceof check.
The constructor accepts agent for configuring outgoing requests through an HTTP proxy.
The constructor accepts tls for custom TLS configuration, including requests to servers with self-signed certificates.
Behavior and default changes 1
AuthorizationError now populates Error.cause with the underlying error when one is available; original still carries the same value.
@slack/oauth 39 changes
Breaking changes 7
Support for this Installation Store method was dropped; handle org-wide installations through storeInstallation and fetchInstallation instead.
HTTPReceiver replaces ExpressReceiver as the default receiver, enabling easier use with other web frameworks; use ExpressReceiver for custom routes.
Node 12.13.0 is the minimum required Node version.
npm 6.12.0 is the minimum required npm version.
TypeScript 4.1 is the minimum required TypeScript version.
Support for orgAuthorize was dropped; use authorize for both single-workspace and org-wide app installations.
Support for this Installation Store method was dropped; handle org-wide installations through storeInstallation and fetchInstallation instead.
Tooling 1
Build support for Node 24 was added.
Fixes and other changes 1
Files are now written to the file installation store using path.join.