What a Slack token looks like

Bot tokens start with xoxb-, user tokens with xoxp-, and app-level tokens with xapp-. Incoming webhook URLs start with https://hooks.slack.com/services/.

A fake example, in the right format:

xoxb-000000000000-1111111111111-FakeDemoSlackTokenOnly

ScrubLogs replaces it with <SLACK_TOKEN_1>.

Why a leak is dangerous

A bot or user token can read channels and messages it has access to and post as your app or as you, a common route for phishing inside a company.

If yours leaked: rotate it

Redacting a copy doesn’t un-leak the original. If the real value was shared anywhere, replace it:

1. In your app’s settings at api.slack.com, open OAuth & Permissions and revoke or rotate the token.
2. For a leaked webhook URL, remove that webhook and create a new one.
3. Ask a workspace admin to review the access logs.