Fredrin

Slack integration — setup and usage guide

Fredrin's Slack integration is two-way: your board pushes review-ready and agent-blocked alerts into a Slack channel, and your team files tickets by just tagging the bot — @Fredrin create a task to fix the login flow — in any conversation where the work came up.

It is bring-your-own-app: you create a small Slack app in your own Slack workspace and paste its bot token into Fredrin. Fredrin hosts no shared Slack app, so nothing about your Slack workspace is visible to anyone else; the token and signing secret are stored encrypted and never logged.

What you get

  • Review-ready alerts — the moment a ticket lands in the Review column (a Worker finished and opened a PR), the channel gets :mag: Ready for review — FRED-XXXX <title>.
  • Agent-blocked alerts — when a Worker stops and needs a human, :no_entry: Agent blocked — needs your input — FRED-XXXX <title>.
  • @Fredrin mentions — natural-language intake, answered in a thread:
    • @Fredrin create a task to <what needs doing> (also file a ticket:, add an issue for, …)
    • @Fredrin status — per-column ticket counts
  • /fredrin slash command (optional) — the same commands as a slash command, answered privately: /fredrin new <title>, /fredrin status, /fredrin help.

Prerequisites

  • A Fredrin project (in the desktop app) you want to wire up.
  • Permission to create and install apps in your Slack workspace.
  • About ten minutes.
  • A Fredrin deployment with CONNECTOR_ENCRYPTION_KEY set. It is required to save any pasted-key connector; without it the Connectors panel shows a "connecting is unavailable" banner. (Self-hosting only — it is already set on fredrin.com. That banner also names OAuth client IDs, which Slack does not need.)

1. Create the Slack app

  1. Open api.slack.com/apps → Create New App → From scratch. Name it (e.g. Fredrin) and pick your Slack workspace.
  2. OAuth & Permissions → Scopes → Bot Token Scopes → add chat:write (this is what lets the bot post alerts and reply to mentions).
  3. You also need app_mentions:read — without it Slack never delivers app_mention events, so @Fredrin stays silent no matter what else is set up. Slack normally attaches it for you when you subscribe to the app_mention bot event in step 4 below; after that, come back to this page and confirm it is actually listed, and add it by hand (then reinstall) if it isn't.
  4. OAuth & Permissions → Install to Workspace → authorize.
  5. Copy two values — you'll paste both into Fredrin:
    • the Bot User OAuth Token (OAuth & Permissions; starts xoxb-)
    • the Signing Secret (Basic Information → App Credentials)

2. Pick the alert channel

  1. Choose (or create) the channel alerts should land in, e.g. #fredrin.
  2. Invite the bot to it: type /invite @Fredrin (your app's name) in the channel. The bot can only post — and hear mentions — where it has been invited.
  3. Copy the Channel ID: click the channel name → About tab → the ID is at the bottom (it starts with C). Use the ID, not the channel name.

3. Connect it in Fredrin

Do this before step 4 — Slack's event-URL handshake is verified against the signing secret you store here.

  1. In the Fredrin desktop app, open your project → Project settings → Connectors → Slack.
  2. Paste the Bot User OAuth Token, the Signing Secret (enables @Fredrin mentions and /fredrin; alerts work without it), and the Alert channel ID (enables alerts; mentions work without it).
  3. Click Connect Slack for this project — or Connect for workspace (workspace owners) to serve every project in the workspace with one app.

A note on rotating the bot token later: use Update credentials on the connected Slack row — not Disconnect. Paste the new xoxb- token and leave the signing-secret and channel fields blank; blanks keep the stored values, so mentions and alerts keep working. Disconnecting first is a genuine reset: it revokes the stored credential, so the signing secret does not carry forward and you must paste it again.

4. Enable @Fredrin mentions

Back in your Slack app's settings:

  1. Event Subscriptions → toggle Enable Events on.
  2. Request URL: https://www.fredrin.com/api/webhooks/slack — it should show Verified within a moment (if it doesn't, finish step 3 first: the handshake is rejected until the signing secret is connected in Fredrin).
  3. Subscribe to bot events → Add Bot User Event → app_mention.
  4. Save Changes, and reinstall the app if Slack prompts for it.

5. (Optional) add the /fredrin slash command

Mentions cover intake; add the slash command only if your team prefers it — its replies are private to the invoker instead of threaded in the channel.

  • Slash Commands → Create New Command: command /fredrin, Request URL https://www.fredrin.com/api/webhooks/slack, description File and track Fredrin tickets, usage hint new <title> | status | help.

6. Try it

  • In a channel the bot is in: @Fredrin create a task to test the Slack integration. The bot replies in a thread with the ticket identifier and column; the ticket is on your board's Backlog.
  • @Fredrin status → per-column counts.
  • Move any ticket into Review (or wait for a Worker to finish one) — the alert appears in your alert channel.

Using it day to day

  • Filing tickets. Tag the bot with what you need: @Fredrin create a task to tighten the signup copy. Verbs create/add/ file/open/make with task/ticket/issue all work, joined by to/for/about/: — write it how you'd say it. The rest of the message becomes the ticket title (Slack formatting is cleaned up), the ticket lands in the project's entry column (Backlog on a default board), and the bot confirms in a thread. The ticket's description records that it came from Slack, attribution goes to the member who connected Slack, and a title identical to one filed in the last 24 hours is rejected as a duplicate.
  • Several projects on one Slack app? Target one by slug: @Fredrin create a task in my-project: <title> and @Fredrin status my-project. With a single connected project no prefix is needed. Ordinary colons in titles are safe — a prefix only routes when it matches a real project slug.
  • Board glance. @Fredrin status lists per-column counts (threaded reply); /fredrin status does the same privately.
  • Privacy. Slash replies are ephemeral (only you see them); mention replies are threaded in the channel. Alerts carry the ticket identifier and title only, never agent conversation content.
  • Acting on an alert. Alerts name the ticket (FRED-XXXX); open the Fredrin desktop app to review the diff and ship or send back.

Troubleshooting

  • The event Request URL won't verify in Slack. Connect the Slack connector in Fredrin first (with the Signing Secret pasted) — the handshake is signature-verified, so an unconnected secret is rejected — then retry the URL. Also check it is exactly https://www.fredrin.com/api/webhooks/slack.
  • @Fredrin gets no reply. The bot must be in the channel (/invite @Fredrin); the app must be subscribed to the app_mention event (step 4); and the connector must be connected with the signing secret.
  • /fredrin shows a Slack error ("dispatch_failed"). Same causes: request URL wrong, or the connector was connected without the signing secret → reconnect and paste it.
  • No alerts arrive. Three usual causes: no Alert channel ID was set (reconnect and add it), the bot was never invited to the channel (/invite @Fredrin), or the channel name was pasted instead of the C… channel ID.
  • "Slack rejected the bot token." The token was revoked or reinstalled away. Reinstall the app to your Slack workspace and reconnect with the fresh xoxb- token — blank optional fields keep their stored values.
  • Commands rejected after long queues or clock skew. Requests older than five minutes are refused (replay protection). Just re-run the command.

Security notes

  • The bot token and signing secret are stored AES-256-GCM-encrypted in your Fredrin workspace and are never logged or shown again.
  • Every inbound request — mention, handshake, or slash command — is verified against your app's signing secret (timing-safe HMAC with a five-minute replay window) before anything is read or created. Unverified requests are rejected.
  • Redelivered events are deduplicated, and the bot never acts on bot-authored messages (no reply loops).
  • Alerts are one-way notifications with ticket metadata only; disconnecting the connector stops both directions immediately.