authentication fails (enterprise)

[pmunin]

I have slack desktop app installed on my Mac, authenticated in enterprise workspace.

agent-slack auth import-desktop
error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT

Logged in via chrome, didn't help:

agent-slack auth import-chrome
Could not extract tokens from Chrome. Open Slack in Chrome and ensure you're logged in.

I have two chrome profiles, not sure if this is related, there are no options in cli about profile selection

Only way worked is pulling cookies from browser dev tools and setting them up manually

[nwparker]

I imagine this is a Slack enterprise specific issue, but I don't have a good way to verify or debug it 😅
Namely, it might be on Slack enterprise installs something is encrypted (thus the BAD_DECRYPT error).

I'm happy if anyone else can help to confirm this issue on enterprise installations

With that being said, it sounds like at least one part here can be immediatly improved:

I have two chrome profiles, not sure if this is related, there are no options in cli about profile selection

I'll take a deeper look into this and try to make a PR. Thank you for reporting

[jozefizso]

We have this issue on a Slack with SSO logins.

agent-slack auth import-chrome
Could not extract tokens from Chrome. Open Slack in Chrome and ensure you're logged in.

agent-slack auth import-desktop
Could not locate xoxd-* in decrypted Slack cookie
(node:35637) ExperimentalWarning: SQLite is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)

The browser has only the xoxd-* cookie set.

Name	Value	Domain	Path	Expires	Size	HttpOnly	Secure	SameSite	Priority
b	.591cdfcf84eec8af7a7a3a101520c9b1	.slack.com	/	2027-03-31T20:39:45.106Z	34		✓	None	Medium
d	xoxd-qkh..F1jkColwPegFPrKI1	.slack.com	/	2027-03-31T20:39:49.332Z	220	✓	✓	Lax	Medium
d-s	1771965585	.slack.com	/	Session	13	✓	✓	Lax	Medium
lc	1771965585	.slack.com	/	2026-03-26T19:39:44.885Z	12		✓	Lax	Medium
m	enQtMTA1...02048353465e8245a9d5caf61edfa7a2e548e829c4491572729d70a6b5e58d85%7C151.186.180.87	.slack.com	/	2026-02-24T20:49:31.206Z	193		✓	None	Medium
tz	60	.slack.com	/	2027-02-25T02:28:10.000Z	4				Medium
utm	%7B%7D	.slack.com	/	2026-03-10T19:47:06.686Z	9		✓	None	Medium
x	591cdfcf84eec8af7a7a3a101520c9b1.1771965564	.slack.com	/	2026-02-24T21:02:06.686Z	44		✓	None	Medium

[jozefizso]

Codex suggested to enable the View > Developer > Allow JavaScript from Apple Events on macOS to import tokens from Google Chrome.

This did not work for me.

It then rewrote code to import the cookies from file system, because the d cookie is HttpOnly and it cannot be access from JavaScript context.

[nwparker]

Thanks for sharing @jozefizso , happy for any PRs here since I don't have a way to test or validate the behavior on my end

[Cluas]

We had the same issue, I rewrote this tool with go to fix it. https://github.com/Cluas/slackctl

[sudhanshug16]

I hit the same auth import-chrome failure on macOS with agent-slack 0.9.3, and was able to narrow it down to the Chrome importer reading the Slack d cookie from page JavaScript.

Observed behavior:

agent-slack auth import-chrome
Could not extract tokens from Chrome. Open Slack in Chrome and ensure you're logged in.

Diagnostics from the logged-in Slack tab:

• AppleScript tab discovery worked; Chrome had an active https://app.slack.com/client/... tab.
• AppleScript JavaScript execution worked; document.title and localStorage were readable.
• localStorage.localConfig_v2 contained one team with an xoxc-* token.
• document.cookie did not expose the Slack d cookie.
• Chrome's SQLite cookie DB did contain .slack.com cookie d, but with is_httponly = 1.

So this line in the Chrome importer cannot work for this current Chrome/Slack state:

document.cookie.split('; ').find(c => c.startsWith('d='))?.split('=')[1] || ''

I locally patched the installed CLI to keep the existing page-JS path first, then fall back to reading/decrypting Chrome profile cookie DBs (Default, Profile 1, etc.) using the same Chrome Safe Storage + Chromium cookie decrypt approach already used by the Brave importer. After that fallback, agent-slack auth import-chrome succeeded and agent-slack auth test returned ok: true.

This may not be enterprise-specific: the workspace I tested against reports is_enterprise_install: false from auth.test. The common factor appears to be Slack's d cookie being HttpOnly, not whether the workspace is Enterprise Grid.

[nwparker]

Status update after triage:

• Chrome side (SSO users hitting the HttpOnly d cookie: "Could not extract tokens" / "Could not locate xoxd-*") — fixed by the Chrome importer fallback in Takeover #108: Chrome import for HttpOnly cookie (needs live smoke test) #122 (takeover of Fix Chrome import for HttpOnly Slack cookie #108): when the d cookie isn't page-visible, it reads Chrome's profile cookie DB and decrypts v10/v11 with Chrome Safe Storage. Merges after a live smoke test.
• Desktop side (import-desktop → error:1e000065 … BAD_DECRYPT on Enterprise Grid) — still open. Reproducing this needs an Enterprise Grid Slack Desktop install, which we don't have, so we can't verify a fix. Keeping this issue open scoped to the desktop-enterprise decrypt path. If anyone on Enterprise Grid can share what encryption their Cookies DB uses, that would unblock it.