Slack bot hosting, Bolt in either language
Bolt for JavaScript and Bolt for Python both run here unchanged. Socket Mode needs nothing but two tokens and fits the free plan; HTTP mode needs a request URL, which is the app's own https address.
Socket Mode, the one that needs no address
const { App } = require("@slack/bolt");
const app = new App({
token: process.env.SLACK_BOT_TOKEN,
appToken: process.env.SLACK_APP_TOKEN,
socketMode: true,
});
app.message("hello", async ({ message, say }) => {
await say("hello <@" + message.user + ">");
});
app.start();Slack opens the connection from your side, so there is no request URL to verify and nothing for Slack to reach. That is the setup to start with, and it runs on the free plan as it is. Bolt for Python is the same shape: App(token=..., ) with SocketModeHandler.
HTTP mode and the request URL
In HTTP mode Slack posts events to a URL you give it. Listen on 0.0.0.0 and the PORT the panel sets, give the app a web address, and the request URL is https://name.fadehost.app/slack/events. Two things Slack insists on: a reply within three seconds, so acknowledge first and do the work after, and a signature check with your signing secret on every request.
The three secrets, and where they live
- SLACK_BOT_TOKEN, the bot token that starts with xoxb.
- SLACK_APP_TOKEN, the app-level token that starts with xapp, for Socket Mode.
- SLACK_SIGNING_SECRET, for verifying requests in HTTP mode.
All three are environment variables on the app's page. The panel masks the values and injects them when the app starts, and nothing secret goes in the repository.
Scheduled posts and slash commands
A Bolt app that posts a daily summary keeps its schedule inside the process, with node-cron or APScheduler, because the process is always on. Slash commands and interactive components work in both modes; in HTTP mode they are the same three-second rule as events.
Frequently asked questions
Socket Mode or HTTP mode?
Socket Mode for anything internal: no address, no signature checks, works on the free plan. HTTP mode when the app is distributed or you want a plain web endpoint, which needs a web address on a paid app so it stays awake.
Which Bolt version?
Bolt for JavaScript from package.json, Bolt for Python from requirements.txt. Both are detected from the repository and need no special start command beyond your own.
Can one app serve Slack and something else?
Yes. Bolt can mount on an Express or FastAPI server, so the same app can answer Slack events on one path and your own routes on another.
Can a free bot reach the API it needs?
A free app's outbound traffic follows a fixed list: DNS, HTTP and HTTPS on the usual ports, the database ports, and some game and voice ports. Anything that calls an API over HTTPS is covered. A paid app may reach everything, or whatever list you give it, and the Firewall tab names what was refused.
What happens when I push a commit?
With auto-deploy on, every push to the branch you chose redeploys the bot: install, build if there is one, start. The live console shows each step and the crash doctor explains a failed start in plain words.
What does the free plan include?
One bot or app per verified account: 256 MB of memory, a quarter of a vCPU, 3 GB of disk under /data and 1 GB of traffic a day, with deploys on push, the live console, the crash doctor and rollback. The process stays on; only a web address sleeps when nobody is using it. A free app runs in whichever region has room for it. A paid plan from $2 a month gives the bot 1 GB and a whole vCPU, lets you pick the region and drops the traffic limit.