What you are making
Slack sends an event to n8n when something happens in a channel. n8n confirms receipt immediately, then decides whether the event matters.
Prepare the n8n webhook
- Create a POST Webhook trigger.
- Use the production URL, not the temporary test URL.
- Give the webhook a long, random path that cannot be guessed.
- Set its response mode to use a Respond to Webhook node.
- Publish the workflow before asking Slack to verify the URL.
A random path reduces casual noise, but it is not proof that a request came from Slack.
Verify Slack’s challenge
In your Slack app, open Event Subscriptions, turn events on, and paste the n8n production URL into Request URL. Slack sends a url_verification payload. Route that request to a Respond to Webhook node and return the challenge value as plain text.
Slack should show a green verified mark before you subscribe to message events.
Subscribe only to what you need
For replies in a public channel, subscribe to the appropriate channel-message bot event and grant the matching history scope. Private-channel messages require the private-channel history scope and the bot must be invited to that channel.
Filter incoming events by workspace, channel, event type, thread, and bot/user identity. Ignore the bot’s own messages so a confirmation reply cannot trigger another run.
Acknowledge before doing work
Slack expects a successful HTTP response within three seconds and retries failed deliveries. Return a simple 200 or ACK immediately, then do slow API calls afterward. Store or check Slack’s event ID if duplicates would cause damage.
Verify every real request
Before processing a message, verify Slack’s X-Slack-Signature using the request timestamp, raw request body, and the app’s signing secret. Reject stale timestamps and mismatched signatures.
Do not rely on the old verification token, a hidden webhook URL, or a matching message shape. A webhook that can change data or workflows must not accept unsigned public requests.
Check the connection
Post one harmless message in the subscribed channel. Confirm that n8n receives one event, returns success quickly, identifies the correct channel and user, and ignores messages created by the bot itself.
Official references: Slack Events API, HTTP request URLs, and verifying Slack requests.