Make authenticated requests with a slackbot

Question

I followed the tutorial on the Google Cloud Run page and I have created a small, private Google Cloud Run API. Now I can use curl as described here to make requests to my API:

curl -H "Authorization: Bearer $(gcloud auth print-identity-token)" SERVICE_URL

So far so good. Now I would like to build a slackbot. The slackbot should respond to slashcommands and whenever a certain slashcommand is issued it should 1) authenticate itself with the API and then 2) issue a command.

Is that possible? I looked around in the entire Slack API documentation, but could not find an example in which a Slack Bot had to authenticate itself with another service. Could someone maybe point me to a guide/tutorial where the author implemented a private API in the Google Cloud that is called from a slackbot?

Answer 1

It's not possible. Instead of giving Slack the ability to make an authenticated request to your Cloud Run instance, configure it to allow unauthenticated access and instead validate that the event from Slack is valid by validating the token provided in the request.

This is described in Slack's Event's API documentation:

token: The shared-private callback token that authenticates this callback to the application as having come from Slack. Match this against what you were given when the subscription was created. If it does not match, do not process the event and discard it.