Slack Secure Send v1

Overview

Slack Secure Send integrates SparkVault's Spark system directly into Slack. Users can send encrypted, self-destructing secrets to teammates using the /secret slash command. Each secret is encrypted with post-quantum cryptography and automatically destroyed after being read.

Key Features

• /secret command: Send secrets from any Slack channel or DM. /secret @user or /secret #channel pre-selects the recipient
• Send to a person or channel: One conversation per secret: a user DM, public channel, private channel, or group DM
• Post-quantum encryption (ML-KEM-1024): Future-proof cryptographic security
• Burn-after-read guarantee: Secrets are destroyed immediately after viewing
• Configurable expiration: Set TTL from 1 minute to 24 hours
• Usage analytics: Track secrets sent by user, team, and time period

How It Works

Command Syntax

The /secret command accepts an optional recipient argument that pre-selects the conversation in the send modal:

Modal Options

App Home & Direct Messages

The integration also provides a SparkVault App Home inside Slack:

• Home tab: Opening the SparkVault Home tab publishes an explainer of burn-after-read sharing and how to use /secret. When the account's storage or bandwidth capacity is running low or exhausted, the Home tab shows a proactive capacity warning: billing admins get an Add capacity button into the billing page, while members are directed to ask their account admin.
• Welcome message: The first time a user opens the SparkVault Messages tab, a one-time welcome DM explains how to share secrets with /secret.
• DM help: The app is not conversational. Direct messages to the bot receive a help reply pointing at the /secret command. This is why the im:history scope is requested.

Installation

Slack Secure Send requires OAuth installation from the SparkVault dashboard. The app requests minimal permissions, only what's needed to receive slash commands and post messages.

Required OAuth Scopes

Installation Steps

1. Navigate to Integrations → Slack in the SparkVault dashboard
2. Click "Add to Slack" to begin the OAuth flow
3. Select your Slack workspace and authorize the requested permissions
4. You'll be redirected back to SparkVault with installation confirmed
5. The /secret command is now available in your workspace

API Endpoints

While most Slack integration happens through the slash command, the following API endpoints are available for programmatic access and integration management.

Analytics

curl -X GET 'https://api.sparkvault.com/v1/apps/slack/analytics?start_date=2024-01-01&end_date=2024-01-31' \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

{
  "type": "usage_records",
  "data": {
    "records": [
      {
        "date": "2024-01-15",
        "slack_user_id": "U1234567890",
        "slack_username": "john.doe",
        "sparks_created": 12,
        "sparks_read": 10
      },
      {
        "date": "2024-01-16",
        "slack_user_id": "U1234567890",
        "slack_username": "john.doe",
        "sparks_created": 8,
        "sparks_read": 7
      }
    ],
    "truncated": false,
    "totals": {
      "sparks_created": 20,
      "sparks_read": 17
    },
    "installation": {
      "team_id": "T1234567890",
      "team_name": "Acme Corp",
      "installed_at": "2024-01-01T00:00:00.000Z"
    }
  }
}

truncated is true only when the requested window exceeded the analytics read cap; totals would then be partial sums over the returned records.

{
  "type": "daily_summary",
  "data": {
    "date": "2024-01-15",
    "total_sparks_created": 45,
    "total_sparks_read": 38,
    "users": [
      { "slack_user_id": "U1234567890", "slack_username": "john.doe", "sparks_created": 15, "sparks_read": 12 },
      { "slack_user_id": "U0987654321", "slack_username": "jane.smith", "sparks_created": 10, "sparks_read": 9 }
    ]
  }
}

users lists per-user counts for the requested day, sorted by sparks_created descending.

Uninstall

curl -X DELETE 'https://api.sparkvault.com/v1/apps/slack/uninstall' \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

{
  "uninstalled": true,
  "account_id": "acc_01hq3vxk9m...",
  "team_id": "T1234567890"
}

Webhook Endpoints (Internal)

The following endpoints support the integration during normal operation. The webhook endpoints are called by Slack's servers; the OAuth callback is called by the SparkVault frontend after Slack redirects back from authorization. They are documented here for transparency but should not be called directly by your application.

Error Handling

An empty analytics window is not an error: the endpoint returns an empty records array with zero totals.

Billing

Slack Secure Send is included with your SparkVault subscription. Billing is license-based. There is no per-secret charge, and no per-spark cost is tracked or billed.

Security Considerations

• Secrets never stored in Slack: Only a notification message with a View Secret button, carrying the spark ID, is posted to Slack. The encrypted content lives in SparkVault's infrastructure.
• Post-quantum encryption: All secrets use ML-KEM-1024, providing security against future quantum computer attacks.
• Burn-after-read: Once a secret is viewed, the encryption key is destroyed. There is no way to recover the content after viewing.
• Time-limited secrets: Unread secrets automatically expire after the configured TTL (max 24 hours), ensuring secrets don't linger indefinitely.
• In-Slack display cap: Slack can only display up to 3,000 characters. An oversized secret is refused at view time before the burn-read, leaving the secret intact until it expires on schedule.
• Audit trail: All secret creation and viewing events are logged with Slack user context for compliance and security monitoring.
• OAuth token security: OAuth tokens are stored encrypted and can be revoked at any time by uninstalling the app.

Best Practices

• Use short expiration times: For highly sensitive secrets, use the shortest practical expiration (1 or 5 minutes) to minimize exposure window.
• Send to specific users: When possible, send secrets directly to the intended recipient rather than posting to a channel.
• Monitor analytics: Regularly review usage analytics to identify unusual patterns or potential misuse.
• Train your team: Ensure team members understand the burn-after-read behavior and save important information before the secret is destroyed.
• Don't screenshot secrets: While we can't prevent it, encourage users not to screenshot secrets as this defeats the security model.

Get Started

Install Slack Secure Send and start sharing secrets securely with your team.