Slack — Workspace Token Cache

Slack — Workspace Token Cache keeps the Slack bot of each workspace ready for the workflows that post to Slack. It reads the bot accounts from Tooling and Access, keeps one row per Slack workspace in an n8n Data Table for 15 minutes, and answers other workflows with the bot token and bot user of the workspace they ask for. It refreshes every workspace every five minutes, so a caller usually gets an answer without reaching Airtable.

It writes to no business system. Its only output is the n8n Data Table slack_workspace_token_cache, which is storage inside n8n, and the answer it returns to the workflow that called it. The Tooling and Access maintainer owns the bot accounts it reads.

Flow

Generated from the n8n version in the box above: every box is a node and every arrow is a connection in n8n. Pink pills are triggers, yellow hexagons are If and Switch nodes with their outputs on the arrows, blue cylinders read (Airtable, Data Table, HTTP GET), green cylinders write, purple boxes call another workflow, and dashed arrows are error outputs.

flowchart TD
  subgraph g0["Triggers"]
    n2(["Every 5 Minutes"]):::trigger
    n11(["Refresh Manually"]):::trigger
    n9["Refresh All Workspaces"]:::logic
    n16(["Token Request"]):::trigger
    n4["Normalize Request"]:::logic
    n10{{"Refresh All?"}}:::decision
  end
  subgraph g1["Answer from the cache"]
    n8[("Read Workspace Cache<br/><small>get n8n Data Table slack_workspace_token_cache</small>")]:::read
    n1["Evaluate Cache"]:::logic
    n12{{"Refresh Needed?"}}:::decision
    n14["Return Cached Result"]:::logic
  end
  subgraph g2["Refresh from Airtable"]
    n7[("Read Cache for Refresh<br/><small>get n8n Data Table slack_workspace_token_cache</small>")]:::read
    n6[("Read Bot Accounts<br/><small>GET Tooling Tool Account</small>")]:::read
    n0["Build Cache Rows"]:::logic
    n3{{"Has Cache Rows?"}}:::decision
    n5[("Persist Workspace Tokens<br/><small>upsert n8n Data Table slack_workspace_token_cache</small>")]:::write
    n15["Return Refreshed Result"]:::logic
  end
  subgraph g3["Errors"]
    n13["Return Cache Error"]:::logic
  end
  n2 --> n9
  n9 --> n4
  n11 --> n9
  n16 --> n4
  n4 --> n10
  n4 -.->|error| n13
  n8 --> n1
  n8 -.->|error| n13
  n1 --> n12
  n1 -.->|error| n13
  n7 --> n6
  n7 -.->|error| n13
  n6 --> n0
  n6 -.->|error| n13
  n0 --> n3
  n0 -.->|error| n13
  n5 --> n15
  n5 -.->|error| n13
  n10 -->|true| n7
  n10 -->|false| n8
  n12 -->|true| n7
  n12 -->|false| n14
  n3 -->|true| n5
  n3 -->|false| n15
  n15 -.->|error| n13
  classDef trigger fill:#fde7f3,stroke:#d6409f,color:#111
  classDef decision fill:#fff7e0,stroke:#c99a00,color:#111
  classDef read fill:#e8f1ff,stroke:#3b82f6,color:#111
  classDef write fill:#e7f8ee,stroke:#16a34a,color:#111
  classDef subflow fill:#f3e8ff,stroke:#9333ea,color:#111
  classDef wait fill:#f1f1f1,stroke:#888,color:#111
  classDef logic fill:#ffffff,stroke:#999,color:#111

Systems it touches

Read Bot Accounts is an HTTP Request node with the Airtable token credential “Airtable PAT (Fully Scoped)”. Its filter and the fields it reads use field IDs, so renaming Kind, Access Token, External Identifier or Workspace (External Identifier) in Tooling does not break it. See Tooling and Access automations for the Tool Account records.

Two workflows call it through Token Request and wait for the answer unless noted:

Triggers

Normalize Request trims workspaceId and turns cacheOnly, forceRefresh and refreshAll into true only when the caller sent the boolean true. Without refreshAll, the workspace ID must look like a Slack team ID (T followed by capital letters and digits); otherwise it throws INVALID_WORKSPACE and the caller gets the error answer.

Refresh All? sends refreshAll to the refresh path and everything else to the cache path.

Answer from the cache

Read Workspace Cache gets the Data Table rows whose workspace_id is the requested workspace. Evaluate Cache accepts the row only when there is exactly one, it has an access_token, it has no cache_error, and expires_at is more than five seconds away.

On an error, Refresh Needed? goes to the refresh path, unless the caller sent cacheOnly: then Return Cached Result returns the error right away, without Airtable. The contract note on the canvas reserves cacheOnly for Slack interactive clicks, which must be answered quickly.

Refresh from Airtable

1. Read Cache for Refresh reads every row of the Data Table, even when only one workspace is refreshed.
2. Read Bot Accounts reads Tool Account rows whose Kind is bot, 100 per page, following every page, once per execution, with a 15-second timeout per request.
3. Build Cache Rows groups the bot accounts by each value of Workspace (External Identifier) that looks like a Slack team ID. For each workspace to refresh it builds one row, or an error code:

The workspaces to refresh are the requested one, or, with refreshAll, every workspace found in Tool Account plus every workspace already in the Data Table. A workspace that is only in the Data Table gets BOT_NOT_CONFIGURED, which clears its token.

4. Has Cache Rows? skips the write when there is nothing to write (only possible with refreshAll and no workspace anywhere).
5. Persist Workspace Tokens upserts each row by workspace_id.
6. Return Refreshed Result answers the caller. After refreshAll it returns counts: workspaces, ready and invalid. For one workspace it returns the same answer as a valid cache hit with source refresh, or the row’s error code, or CACHE_EXPIRED.

Fields written

Tool Account fields read (Tooling and Access)

Data Table columns written (Persist Workspace Tokens)

Nodes

The workflow has 18 nodes: 17 that run and one sticky note. For an If node, output 0 is true and output 1 is false. Nodes set to continue on an error output (Normalize Request, Read Workspace Cache, Evaluate Cache, Read Cache for Refresh, Read Bot Accounts, Build Cache Rows, Persist Workspace Tokens and Return Refreshed Result) send failures out of output 1, drawn as dashed arrows in the flow.

Connections

Return Refreshed Result has no outgoing connection on output 0: its item is the answer returned to the caller.

Settings and error handling

Every failure inside the flow goes to Return Cache Error, which answers ok false, error TOKEN_CACHE_UNAVAILABLE and stage: the name of the last node it finds executed, checked from the end of the refresh path backwards. Failures in the nodes with an error output become this answer instead of a failed execution; the caller decides what to do with it.

Known gaps

These come from the node configuration. Executions are not saved, so n8n keeps no history of past runs to compare with.

Recover a partial write

The Data Table can be rebuilt at any time, so recovery is a refresh.

Keep this page in sync

The box at the top shows the n8n version this page describes. Open the workflow in n8n: when its last save is newer than the date in the box, this page is out of date until the next review. Every node and every connection of that version is listed in Nodes and Connections.