macOS Chrome extraction path for Slack client token (unsupported / FYI only)

[kehao95]

We validated a non-public extraction path for Slack client auth on macOS using Chrome. This is not an official Slack-supported flow, but it is useful to document publicly as a fallback path for advanced users.

Positioning:

• This is not the recommended authentication path for slk.
• This should not be presented as the primary setup flow.
• It is acceptable to record it publicly as a reference for users who understand the tradeoffs.

What worked:

• xoxc-... can be recovered from Chrome profile local storage for an already logged-in Slack Web session.
• xoxd-... can be recovered from Chrome's .slack.com d cookie after decrypting the cookie store on macOS.
• In this repo, the existing runtime already has partial support for consuming xoxc + xoxd.

Observed macOS Chrome locations:

• Local storage: ~/Library/Application Support/Google/Chrome/<Profile>/Local Storage/leveldb
• Cookies DB: ~/Library/Application Support/Google/Chrome/<Profile>/Cookies

Practical extraction path that worked during validation:

1. Identify Chrome profiles that already have Slack cookies.
2. Search the profile's local storage LevelDB files for localConfig_v2 or xoxc-.
3. Read the .slack.com cookie named d from the profile cookie DB.
4. On macOS, use the Keychain entry for Chrome Safe Storage to decrypt the cookie value.
5. Treat both values as sensitive credentials.

What we observed locally:

• Multiple Chrome profiles had .slack.com cookies.
• A Slack-active profile exposed localConfig_v2 in LevelDB and contained a recoverable xoxc-... token.
• The same profile's cookie DB contained an encrypted .slack.com d cookie that could be decrypted to xoxd-....

Important caveats:

• This relies on Slack Web implementation details, not a stable public API.
• Chrome storage formats and cookie encryption behavior can change.
• This only works when the browser profile already has a valid Slack login session.
• We should avoid presenting this in the README as the default auth flow.

Practical recommendation:

• Keep OAuth user token auth as the default documented path.
• Treat this extraction route as an advanced fallback for users who explicitly want it.
• If we ever expose it in-product, it should carry explicit warnings and clearly say that Slack does not officially support this flow.