# Slack approvals

> Send held actions to a Slack channel and choose who can approve them, from the CLI or Settings.

Source: https://docs.atensecurity.com/docs/operations/slack-approvals

When Thoth holds an action for approval (`STEP_UP`), it can post the request to a Slack channel,
where a reviewer approves or denies it. You choose the channel and the reviewers.

## Connect Slack

Installing the Thoth Slack app is a browser step: in Settings, choose **Connect Slack** and
authorize the app in your Slack workspace. Everything after that can be done from `thothctl`.

```bash
thothctl slack status     # the connected workspace and approvals channel
thothctl slack channels   # channels Thoth can post approval requests to
```

## Choose the approvals channel

```bash
thothctl slack set-channel --channel-name approvals
# or, by ID:
thothctl slack set-channel --channel-id C0123456789
```

## Choose reviewers

Reviewers are members of your organization with a verified email and an active Slack account
under the same email in the connected workspace. List who can be chosen, then set the
reviewers by email. `set` replaces the whole list.

```bash
thothctl slack reviewers candidates
thothctl slack reviewers set --email ana@example.com --email ben@example.com
thothctl slack reviewers list    # the reviewers, and whether Slack approvals are ready
```

`thothctl slack reviewers set --none` removes every reviewer. Held actions then wait for approval
in Thoth until you choose reviewers again.

If someone else changes the reviewers between your read and your save, the save is refused
rather than overwriting their change. Run the command again.

## From an MCP client

Signed in to the [configuration MCP server](https://docs.atensecurity.com/docs/mcp/configure-thoth), an admin's client can
read the setup with `get_slack_approvals`, list who can be chosen with
`list_slack_reviewer_candidates`, and preview a change with `preview_slack_approvals` (a channel
ID, the complete list of reviewer emails, or both). The preview shows the channel and the
reviewers by email; you approve it in the browser with a recent second factor. Approvals apply
to every agent, so the preview's scope must include every agent.

## Who can change this

Changing the channel or the reviewers needs a signed-in admin (`thothctl auth login`) with a
recent second factor, from `thothctl` or an MCP client. API keys cannot change them, and an MCP
client connected with an API key does not see the Slack tools: reviewers decide which held
actions run, so a key that leaked could otherwise appoint an approver. For the same reason there
is no Terraform resource for reviewers yet; it needs the provider to act as a signed-in user.