# Outbound Integration Is Cheap While Inbound Concentrates the Auth Cost ## Claim Posting from an app into a chat tool needs only a webhook URL, but receiving and acting on replies requires full OAuth scoping, event subscriptions, and a reinstall on every scope change, so an integration's real complexity concentrates on the inbound path, not the outbound one. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for platforms (Slack and similar) that structurally separate a no-auth push primitive (incoming webhook) from an authenticated pull/react primitive (OAuth bot token + Events API). - Breaks where a platform unifies send and receive behind one credential, or where the integration only ever needs to notify and never needs to read a reply back. ## Evidence A Bolt.new tutorial building two Slack-connected features shows the asymmetry directly: the outbound "share to Slack" path needs only a webhook URL pasted into a secret. The inbound "reply flows back into the app" path needs a `chat:write` OAuth scope, a Bot User OAuth Token, the channel ID, the signing secret, and an Events API subscription to `message.channels` — and any scope change forces a full app reinstall. ## Links - [[3. Resources/Permanent Notes/An Ops Agent Is Only as Capable as Its System Access]] — contrasts: that note treats access breadth as the capability ceiling; this one locates *where* the cost of that access actually sits (inbound auth, not outbound notification). - [[3. Resources/Permanent Notes/Tool-Interface Choice Shapes Agent Architecture More Than Model Choice]] — applies-in: the webhook-vs-OAuth split is a concrete case of interface choice determining how much integration work an architecture demands. - [[AI & the Future of Knowledge Work MOC]] — applies-in: this is a recurring shape in agent tooling — the AI writes the integration code, but the credential/auth topology remains a human-configured trust boundary. ## Tests / falsifiers - Check whether a chat platform without Slack's webhook/Events-API split (e.g., a platform using a single API key for both directions) still shows the same cost asymmetry. - Track whether "the agent wrote the integration but the human still had to reason about OAuth scopes" recurs across other vibe-coding integration tutorials, or whether this one video is an outlier. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/How to Connect Slack to Your Bolt.new App]] — Bolt.new tutorial walking through both the webhook (outbound) and OAuth/Events API (inbound) integration paths.