Slack Integration Setup

This guide will help you connect Codity to your Slack workspace, so your team can ask about code, pull requests and broken builds without leaving Slack.

Overview

The Slack integration allows Codity to:

• Answer questions about your codebase directly in a channel or DM
• Explain why a CI run failed, using the actual build logs
• Report pull request status, standups and recent activity
• Start a review on a pull request from a pasted link
• Explain a specific review finding in plain language
• Direct-message pull request authors when their review completes
• Deliver scheduled weekly and monthly digests to a channel
• Unfurl GitHub links with what Codity already knows about them

The bot works out which repository and branch you mean from your own recent commits, so you never have to name them. If it guesses wrong, every answer carries a menu to correct it.

Prerequisites

• A Codity account on the Pro plan — Slack is gated behind the slack_enabled plan feature
• An active Codity seat for each developer who wants to ask code questions
• At least one connected provider (GitHub, GitLab, Azure DevOps, or Bitbucket)
• Slack workspace permission to install apps (workspace owner or admin, or an approved app request)
• Admin access to your Codity organization, since the install is bound to it

Setup Steps

Step 1: Connect the Workspace

1. Navigate to Settings

   • Log in to your Codity dashboard
   • Go to Settings → Slack

2. Start the Install

   • Click Connect Slack
   • You'll be redirected to Slack's consent screen showing the permissions Codity requests
   • Choose the workspace you want to connect
   • Click Allow

3. Confirm

   • You'll be returned to Settings with a "Slack workspace connected" message
   • The panel now shows the workspace name and when it was connected

The install link is minted against your logged-in dashboard session and expires after 10 minutes. It is single-use. If you leave the tab open too long you'll see "That install link expired" — just click Connect Slack again.

One Slack workspace maps to exactly one Codity organization. If the workspace is already connected elsewhere, you'll be told so rather than having it silently rebound.

Step 2: Invite the Bot to Your Channels

Codity only sees channels it has been invited to:

/invite @codity

Do this in any channel where you want to ask questions or receive digests. In a private channel, invite the bot the same way.

Step 3: Link Your Identity

Slack accounts and VCS accounts aren't linked natively, so Codity resolves yours automatically — usually correctly, using your Slack profile email against your Codity seat and your commit history.

Check what it worked out:

/codity whoami

If it's wrong or unresolved, set it explicitly:

/codity link <username>

<username> is your version-control username — the one your commits are attributed to. Not your Slack handle, and not your email. Where to find it:

The same person can have a different username on each provider, so use the one for the provider your organization is connected to. Codity names that provider whenever it prompts you to link.

This is validated against your organization's seats, so you can only link to a developer who actually has one. To remove a link:

/codity unlink

Until you're linked, Codity answers at organization scope and blocks the intents that read source code. See Identity Resolution below.

Step 4: Ask Something

Mention the bot in a channel, or DM it directly:

@codity where is authentication handled?
@codity why did CI fail?
@codity my prs

The first reply in a channel arrives in a thread. In a DM, no mention is needed — just type.

Using the Bot

Three Ways to Ask

What You Can Ask

Code questions — answered from your indexed repositories:

@codity where is authentication handled?
@codity how does the retry logic work in the job queue?
@codity what calls resolveUser?

CI failures — reads the actual logs and annotations:

@codity why did CI fail?
@codity is the build green?
@codity <paste a failed workflow run link>

Pull requests:

@codity my prs
@codity what PRs need review?
@codity pr 1423
@codity did that PR land?          (in a thread already about one)

Activity and reporting:

@codity standup                    what you shipped, last 3 days
@codity what changed recently?     last 7 days
@codity which repos have I worked in?
@codity weekly summary
@codity monthly summary
@codity cost                       usage against your plan

Reviews and findings:

@codity review https://github.com/acme/api/pull/1423
@codity explain this finding

Utility:

@codity help
/codity link <username>
/codity whoami
/codity unlink

Reaction Triage

Instead of retyping someone else's message, react to it with :mag:, :mag_right: or :codity:. Codity reads the message the reaction sits on and treats it as the question.

The trigger set is deliberately small and deliberately excludes common reactions like :eyes:, so the bot never barges into a conversation it wasn't pointed at.

Link Unfurling

Paste a GitHub link and Codity adds a card — but only when it has something to add:

• Pull requests unfurl only if Codity has reviewed them, showing the finding summary
• Workflow runs unfurl only if they failed

Slack already renders a link's title and author, so repeating that would just be noise.

The App Home Tab

Click Codity in your Slack sidebar to see your link status, which VCS account the bot is answering about, your most active repositories, and a list of things to try. There's a Refresh button and a link straight to your dashboard.

How It Works

Zero-Friction Context

Codity never stops to ask "which repository did you mean?". It resolves context in this order:

1. The repository or branch you named, if you named one
2. The repository you most recently committed to
3. The channel's most active repository
4. Organization-wide scope

Every scoped answer carries a footer stating which repository and branch it used, and a menu to correct it. A clarifying question is treated as a failure, not a feature.

If the branch you're asking about isn't indexed yet, Codity says so in the footer and answers from the closest indexed branch rather than refusing.

Identity Resolution

Codity walks a confidence-scored ladder to match your Slack account to your VCS identity, resolved once and cached:

What the score changes:

• 95 and above — silent. You're never prompted.
• 75 to 94 — you get your answer first, then a one-time Matched you to octocat. Yes / Not me prompt.
• Below 75 — answered at organization scope, with a nudge to run /codity link <username>.

Links refresh after 30 days for confident matches, 7 days for weaker ones. A link you set or confirmed yourself is never downgraded.

What an Unlinked User Can Do

An unlinked Slack account is not proof of a Codity seat, so intents that read source code are blocked until you link.

Review Notifications

When a review finishes, Codity direct-messages the pull request author a summary of what it found.

This only fires when there is a confident identity link for that author. If Codity isn't sure who to DM, it sends nothing — guessing which colleague to message about someone else's code is a worse failure than staying quiet.

Digests

Weekly and monthly digests are configured in Analytics → Digests. Once your workspace is connected, a Slack channel becomes available as a delivery destination alongside email. A single schedule can deliver to both.

For a digest right now, without waiting for the schedule:

@codity weekly summary
@codity monthly summary

Slack Memory

Codity condenses channel discussion into a durable reference document over time — the decisions your team reaches, the conventions you state, the problems that keep coming back. It is separate from review memory, which is distilled from measured review outcomes rather than from what people say.

This is the only feature that reads conversation the bot wasn't addressed in, so the constraints are strict:

• DMs are never captured. A private exchange is not shared discussion.
• Only channels the bot has been invited to are read at all.
• Secrets and email addresses are redacted before anything is stored.
• Authors are pseudonymised. The document records what the team decided, never who said it — a document containing a personal handle is rejected outright.
• Raw messages are a staging buffer, not an archive. They're deleted once condensed, and unconditionally after 7 days even if condensing never ran.
• Condensing is threshold-driven — 120 new messages, or 7 days in a quiet channel — not per message.

Slack Memory is on by default for channels the bot is in. To turn it off for a channel, contact your Codity administrator; it's an operator-level setting rather than a Slack command, so that once disabled it stays disabled.

Metering

Slack answers count against your plan's usage, the same as reviews and CLI runs. Checks run cheapest-first — installation, then plan, then seat — so a plan problem costs one query rather than a wasted model call.

Answers that cost nothing are not billed. If Codity tells you it couldn't find a pull request, you aren't charged for being told your input was wrong.

Check your position any time with @codity cost.

Permissions Requested

Codity requests these bot scopes at install:

users:read.email is what makes automatic identity matching possible. Without it, every user falls back to organization-wide context until they run /codity link <username> by hand.

Best Practices

1. Link your identity early — one /codity link <username> unlocks code questions and scopes every answer to your own work
2. Invite the bot only where you want it — it reads nothing in channels it isn't in
3. Use the repair menu — correcting a wrong repository once teaches the bot for that thread
4. Ask in threads — follow-up questions in a thread keep their context, so "did that land?" resolves correctly
5. Prefer standup over a digest for daily check-ins — it reads work the platform already narrated and spends no model call
6. Use DMs for anything sensitive — DMs are never captured by Slack Memory
7. Review who has seats — an unlinked user gets degraded answers, not an error, so a missing seat can go unnoticed

Security Considerations

1. Token storage — Slack bot tokens are Fernet-encrypted before storage, and only the Slack service can decrypt them
2. Organization binding — the Slack-to-organization link is decided by your authenticated dashboard session and carried in a single-use, 10-minute state token. Nothing about which organization a workspace belongs to is ever taken from a value Slack supplies
3. One workspace, one organization — a workspace already connected elsewhere is refused rather than rebound
4. Request verification — every request from Slack is signature-verified against the raw request bytes before it is parsed
5. Least privilege — the Slack service holds exactly one outbound secret and never sees your provider credentials
6. Disconnect destroys the credential — disconnecting nulls the stored token in the same statement that retires the record, so a disconnected workspace cannot be silently reactivated
7. Redaction before storage — secrets and emails are stripped from captured messages before they're written anywhere

Disconnecting

Go to Settings → Slack → Disconnect.

This retires the installation and destroys the stored bot token immediately. The record is kept for audit, but the workspace stops working at once. To fully remove the app, also uninstall Codity.ai from your Slack workspace's Apps settings.

Reconnecting is a fresh install — click Connect Slack again.

Troubleshooting

If the integration panel says connected but nothing works, disconnect and reconnect — that reissues the bot token.

Next Steps

• Learn about GitHub setup
• Learn about connecting your VCS
• Learn about managing seats
• Explore Analytics digests
• Check the Getting Started Guide for general setup instructions