Building a Serverless Slack Bot with Bolt and Socket Mode — A Vibe Coding Guide

Choosing the right architecture for a Slack Bot that “keeps running”

As mapped in What You Can Do with Slack Bot and API, Slack automation has two main paths: no-code (Workflow Builder) and custom-built (API/Bolt). Once you go the custom-built route, the next decision is where to run it.

Bolt (Bolt for JavaScript, Python, Java) is Slack’s official Bot framework and supports two execution modes:

This article covers both modes with implementation patterns and a vibe coding walkthrough.

3 problems Bolt solves for you

Without Bolt, using the Slack API directly requires implementing the following yourself:

1. Signature verification: Confirming that requests actually came from Slack (HMAC-SHA256)
2. Event routing: Dispatching different event_type values, command names, and button actions to separate handlers
3. OAuth flow: Handling the app installation process for workspaces

Bolt takes care of all three, so you can focus on the logic — what to do and what to return.

Implementation example 1: Socket Mode (development / internal use)

Socket Mode requires no public URL, making it ideal for local development or running inside a corporate VPC.

import { App } from '@slack/bolt';

const app = new App({
  token: process.env.SLACK_BOT_TOKEN,
  signingSecret: process.env.SLACK_SIGNING_SECRET,
  socketMode: true,
  appToken: process.env.SLACK_APP_TOKEN, // App-level token for Socket Mode
});

// Respond to /hello slash command
app.command('/hello', async ({ command, ack, respond }) => {
  await ack(); // Must acknowledge within 3 seconds
  await respond({
    text: `Hello, ${command.user_name}!`,
    response_type: 'in_channel',
  });
});

// Respond to messages containing "thank you"
app.message('thank you', async ({ say }) => {
  await say('You are welcome!');
});

(async () => {
  await app.start();
  console.log('Bot is running in Socket Mode');
})();

.env file:

SLACK_BOT_TOKEN=xoxb-...
SLACK_SIGNING_SECRET=...
SLACK_APP_TOKEN=xapp-...

Implementation example 2: HTTP Endpoints (production / serverless)

When you want stateless execution (Vercel, Cloudflare Workers, or any serverless HTTP environment), use the HTTP Endpoints approach. It requires a public URL, but each request runs independently and terminates — no always-on process needed. Note that Cloudflare and Vercel do support WebSockets, but choosing HTTP Endpoints gives you a simpler stateless architecture and lower operational overhead.

import { App, ExpressReceiver } from '@slack/bolt';
import express from 'express';

const receiver = new ExpressReceiver({
  signingSecret: process.env.SLACK_SIGNING_SECRET!,
});

const app = new App({
  token: process.env.SLACK_BOT_TOKEN,
  receiver,
});

// Slash command returning a Block Kit message
app.command('/summary', async ({ ack, respond }) => {
  await ack();
  await respond({
    blocks: [
      {
        type: 'section',
        text: {
          type: 'mrkdwn',
          text: '*Today\'s Operations Summary* :bar_chart:',
        },
      },
      {
        type: 'section',
        fields: [
          { type: 'mrkdwn', text: '*Posts*\n42' },
          { type: 'mrkdwn', text: '*Active members*\n18' },
        ],
      },
    ],
  });
});

// Export for Vercel
export default receiver.app;

vercel.json:

{
  "functions": {
    "src/index.ts": {
      "memory": 256,
      "maxDuration": 10
    }
  },
  "routes": [
    { "src": "/slack/events", "dest": "src/index.ts" }
  ]
}

In your Slack App settings under “Event Subscriptions” and “Slash Commands”, set the Request URL to https://<your-vercel-url>/slack/events.

Step-by-step vibe coding implementation

Even without a dedicated software engineer, you can build a Bolt Bot using AI coding tools (Claude, etc.). Use the following prompt template as a starting point:

I want to build a Slack Bot using Bolt for TypeScript
with HTTP Endpoints (ExpressReceiver). Requirements:
- Respond to slash command /ask by echoing the argument
  text back as a Block message
- Deploy to Vercel (serverless)
- Provide package.json, vercel.json, .env.example,
  and src/index.ts as a complete set
- Also tell me what to paste where in the Slack app
  settings after deploying

Also list all required OAuth scopes.

After receiving the code from the AI, verify the following:

1. OAuth scope review: Ensure no unnecessary permissions are granted
2. Signature verification: Confirm signingSecret is used in the setup
3. Error handling: Confirm ack() is always called (failing to call it causes Slack to keep resending the request until timeout)

Bot ideas organized by use case

LLM integration (FAQ, summarization, moderation assistance) will be covered in detail in a future article. Also see Running Content Production with AI for a broader view on AI-driven workflows.

Raw Slack API vs. Bolt: a comparison

For simple notification forwarding only, Incoming Webhooks are sufficient. When you need slash commands or modals, that is when Bolt pays off.

Summary

• Bolt is Slack’s official framework that handles signature verification, routing, and OAuth for you
• Use Socket Mode (no public URL needed) for development and internal tools; use HTTP Endpoints when you want stateless execution in serverless environments
• For vibe coding, specifying “Bolt + TypeScript + HTTP Endpoints + Vercel” gives the AI enough context for accurate output
• The two most common pitfalls are forgetting to call ack() and granting excessive OAuth scopes

If you need help designing or implementing Slack Bot automation, or community automation architecture more broadly, see Rokuse’s Community Development Service. We support everything from workflow design to vibe coding guidance.

Related articles

What Can Slack Bots and APIs Do? — A Complete Map for Automating Community Operations

A pillar article mapping what Slack bots and APIs can do across four areas — messaging & UI, reactions & automation, operations & management, and integration & AI — from no-code Workflow Builder to building your own (vibe coding), for operators and developers.

rokuse.com/en/blog/community/slack-bot-capabilities-map

Expressing Community Operation in Code — Implementation Patterns for Policy, Moderation, and Invite Flows on Slack

We explain implementation patterns for declaratively managing operational policy, moderation, and invite flows in code on top of Slack. We show concrete file structures, automation designs, and a phased adoption path for moving from person-dependent operation to a reproducible system.

rokuse.com/en/blog/community/community-as-code-slack

What Can Discord Bots and APIs Do? — A Complete Map for Automating Community Operations

A pillar article mapping what Discord bots and APIs can do across four areas — messaging & UI, members & roles, moderation, and events/voice/analytics — including when to use off-the-shelf bots versus building your own (vibe coding), for operators and developers.

rokuse.com/en/blog/community/discord-bot-capabilities-map

Running a Discord Bot Serverless on Cloudflare Workers — A Vibe Coding Guide

A practical guide to running a Discord Bot on Cloudflare Workers without a persistent server, covering the Interactions Endpoint model, TypeScript code examples, and how to build it through vibe coding.

rokuse.com/en/blog/community/discord-bot-serverless-workers

Running Content Production AI-First — Rokuse's Production Operations, Fully Disclosed

A pillar article that fully discloses how Rokuse runs blog, audio, and design production "AI-natively," split across the three lines — text, audio, visual — and the steps where humans must stay in the loop.

rokuse.com/en/blog/production/ai-native-content-operations