SparkVault for Slack v1

Overview

Use /sparkvault, SparkVault’s App Home or the SparkVault shortcuts to browse vaults, upload and organize ingots, and share them without leaving Slack. You connect your SparkVault account once, and unlock a vault with your own VMK or DVAK, on a brief SparkVault page. Slack never receives a vault key.

SparkVault for Slack also sends expiring, single-read secrets with /share_secret or /secret. Review the recipient and expiration before sending. The recipient confirms before opening the secret, and reading consumes the Spark in SparkVault.

Vaults and Ingots

1. Run /sparkvault, optionally followed by search words, open SparkVault’s App Home, use the Browse SparkVault shortcut, or use Share from SparkVault on a message to share in its thread.
2. The first time, select Connect SparkVault. A brief SparkVault page asks you to sign in with Slack, which confirms you are the person the link was opened for, then to sign in to the SparkVault account connected to the workspace. A link someone forwards to you does not connect.
3. Choose a vault and unlock it on that page with your VMK or DVAK, for 1, 4, 8, or 24 hours. Keys stay in browser memory unless you explicitly choose encrypted local storage with a separate passphrase.
4. Browse folders, search ingot names by prefix, create folders, upload or replace an ingot with a file from Slack, and rename, move, or delete ingots using your normal permissions.
5. Select Share, choose a durable link or a one-time SparkLink, review who can open it and where it goes, then post it.

Durable links use files.sv and retain the ingot’s public, authenticated, or invitation-only access rules. One-time SparkLinks use x.sv: anyone with the link can use it once before expiration. Creating a SparkLink does not restrict an existing durable share. Slack channel membership never grants SparkVault access automatically.

A share goes to a channel, a thread, a person, or your own direct messages with SparkVault. It starts with the conversation or thread you started from; App Home and the Browse SparkVault shortcut start with your direct messages, and you can choose a channel or a person instead. SparkVault posts in public channels, which it joins, in private channels it was invited to, and in a group DM only when it is already part of it. It reaches a person through its own direct message with them. A destination that reaches people outside your organization is named as such before you post. If delivery cannot be confirmed, check the conversation before sharing again.

Download opens a brief SparkVault page with a Download button, and only that click starts the download in your browser. Slack receives neither the file nor its download link, and no share is created. The app never uploads ingot contents to Slack, fetches shared links for previews, or stores vault keys on its server; a share card carries the link and, if you choose, the ingot name. Each link to a SparkVault page works once, for 15 minutes. Local key storage requires browser Web Crypto, IndexedDB, and Web Locks; manual unlock remains available without it. Files use ordinary storage and transfer capacity.

Installation

1. A SparkVault administrator opens Integrations → Slack.
2. Select Add to Slack, choose the workspace, and authorize the requested permissions.
3. Return to SparkVault to confirm installation. For an existing installation, use Refresh Connection to apply updated permissions.
4. Run /sparkvault for vaults and ingots, or /share_secret or /secret for the secret composer.

Invite SparkVault to a private channel before sending a secret or a share there. No app can be added to a group DM, so SparkVault posts in one only when it is already part of it; otherwise choose a channel or a person.

One-Time Secrets

1. Enter the secret in the composer and review the recipient.
2. Choose an expiration between 1 minute and 24 hours.
3. Select Send Securely. If the recipient is outside your organization, the composer says so, keeps what you entered, and sends only when you select Send Securely again.
4. The recipient receives a notification with a View Secret button.
5. The recipient confirms before viewing. Reading consumes the Spark in SparkVault.

A channel notification can be acted on by eligible members of that conversation; it is not a private message to one person. For a specific recipient, choose the person. The secret appears in a Slack modal after confirmation, so Slack processes its plaintext.

A secret sent from Slack belongs to the Slack integration: it opens only from its notification in Slack, never through a SparkLink, and it does not appear in your SparkVault Sparks list or the API.

Secrets entered in Slack must fit its 3,000-character display limit. Secrets are free on every plan; their usage is recorded for reporting.

Permissions

Every scope but openid is a bot scope. The app requests no channel message-history or file-write scope, and keeps no Slack user token: openid serves Sign in with Slack only. Private channels require an app invitation, and no app can be added to a group DM. New scopes take effect only after an administrator refreshes the workspace connection.

Analytics API

curl 'https://api.sparkvault.com/v1/apps/slack/analytics?date=2026-09-15' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN'

{
  "type": "daily_summary",
  "data": {
    "date": "2026-09-15",
    "total_sparks_created": 3,
    "total_sparks_read": 2,
    "users": [
      {
        "slack_user_id": "U1234567890",
        "slack_username": "alex",
        "sparks_created": 3,
        "sparks_read": 2
      }
    ],
    "truncated": false
  }
}

Date-range responses use type: "usage_records" with records, totals, installation, and truncated inside data. If truncated is true, totals are partial; request smaller date windows. An empty window returns zero counts, not an error. Usage is kept for about 25 days after its last activity, so an older window returns zero counts.

Integration Endpoints

These endpoints support the first-party integration. Slack webhook requests require a valid Slack signature. SparkVault page steps accept only a one-use link SparkVault issued in Slack, sent from the SparkVault page itself.

Disconnecting asks Slack to remove the SparkVault app from the workspace, then ends every member’s SparkVault connection in Slack and disables commands and secret viewing there. When Slack keeps the app, the disconnect still completes and the response’s slack_app_removed is false: a Slack workspace administrator can remove the app in Slack. A 503 SLACK_REMOVAL_UNAVAILABLE means nothing changed; try again in a few minutes. Existing vaults and ingots remain in SparkVault. Unread Sparks retain their normal expiration; disconnecting does not read or destroy them immediately.

Troubleshooting

• Private-channel delivery fails: invite the SparkVault app to that conversation.
• Missing permissions or command: ask the workspace administrator to refresh the connection and verify the current app configuration.
• Secret unavailable: it may have already been read or expired. Ask the sender to create another secret if needed.
• Vault access denied: check your account, license, and VMK or DVAK permissions. The Slack installation does not grant vault access.
• Wrong account or expired link: sign in to the SparkVault account connected to the workspace, or open a new link from Slack.
• Not available to members of other organizations: vaults and sharing in Slack serve the organization that installed SparkVault. People from other organizations in a shared channel can still open a secret sent to them.
• Delivery uncertain: check the destination before sharing again.