Back to blog

How to set up Slack allowlists for OpenCode

Control which Slack users and channels can send requests to OpenCode with Pipa. Set user and channel allowlists during pipa init.

Posted by

To restrict who can send OpenCode work from Slack, run pipa init and set both allowedSlackChannelIds and allowedSlackUserIds. Pipa handles a mention only when its channel and author match those lists.

The short version

Run pipa init, enter the Slack channel IDs and user IDs that should be allowed, then start Pipa. A mention is handled only when both configured lists match.

What allowlists protect

These lists are Pipa's admission control. They decide which Slack mentions Pipa will turn into OpenCode work. They do not change OpenCode's tool permissions, approval rules, or file access. Review those separately before an agent works with sensitive files or commands.

Do not leave this implicit in a shared workspace

By default, Pipa handles mentions from any user in any channel it can see. In a shared workspace, configure both lists.

1. Install Pipa in the folder OpenCode should use

npm install --global @usepipa/pipa
cd /path/to/your/project
pipa init

The folder where you run setup is Pipa's working directory. It gives OpenCode its starting context, but it is not a replacement for OpenCode permissions.

2. Enter the allowed channel and user IDs

During pipa init, enter the comma-separated Slack IDs for the channels and people who should be able to mention Pipa. The resulting local config has this shape:

{
  "allowedSlackChannelIds": ["C0BSE2JTYPR"],
  "allowedSlackUserIds": ["UFWBSCZ54"]
}

Slack IDs are deliberate here: channel names can change, but these IDs identify the exact channel and account you approved.

The complete configuration and matching rules are in Pipa's access-control reference.

How do Pipa's Slack allowlists work?

When both lists have values, Pipa handles a mention only when the channel ID is in allowedSlackChannelIds and the author's ID is in allowedSlackUserIds. A valid user in the wrong channel is ignored. A valid channel with the wrong user is ignored.

Leave one list empty only when you intentionally want that dimension open: an empty channel list allows any channel, and an empty user list allows any user. Leave both empty only for a workspace where that is genuinely safe.

3. Configure it non-interactively when needed

For a scripted setup, pass the same lists as comma-separated environment variables before running the initializer:

export PIPA_ALLOWED_CHANNEL_IDS=C0BSE2JTYPR
export PIPA_ALLOWED_USER_IDS=UFWBSCZ54
pipa init

4. Start Pipa and test a permitted mention

pipa start

Invite Pipa to one of the allowed channels and mention it from an allowed account with a low-stakes request. Then test from a channel or account outside the lists. Pipa should only respond to the permitted mention.

Keep the permission boundary clear

Allowlists answer: who may ask Pipa to start work from Slack? OpenCode permissions answer: what may the agent do after work starts? You need both boundaries. The first limits who can initiate work; the second limits the work itself.

Can I use OpenCode for SEO work in Slack?

Yes. If you use OpenCode for SEO research, content edits, or technical checks from Slack, Pipa lets you keep that work in approved channels and limit who can start it. Allowlists do not add SEO capabilities or change OpenCode's permissions. They only control Slack access to the agent.

Set up OpenCode in Slack

Need the full connection walkthrough? Read the OpenCode Slack setup guide for installation, the Slack app setup, and the first test message. For the shortest install path, start with the OpenCode Slack integration overview.

How to Set Up Slack Allowlists for OpenCode | Pipa