Why does Slack need the challenge echoed back?

It proves the URL is controlled by someone who can read the request body, rather than an arbitrary address someone typed in. Until the echo succeeds, Slack refuses to send any events to the endpoint.

Does it verify the Slack signature?

No. The X-Slack-Signature header is not checked, so the mock echoes the challenge back to anyone who posts a matching body. Signature verification belongs in your real handler and must be tested against Slack itself.

Will it handle real events after verification?

It will accept them and return the same echo shape, which is not what an event handler should reply. Use this template to get through verification, then point Slack at your own endpoint.

Mock the Slack Events API challenge

A POST mock that answers Slack's url_verification handshake by echoing the challenge value back.

Slack will not enable an Events API endpoint until it answers the url_verification handshake by echoing back the challenge value it was sent. This template does exactly that: it reads challenge from the incoming request and returns it, so you can get an endpoint verified before your real handler exists. The response is a single field because that is precisely what Slack's handshake requires.

Accepts an incoming call and replies the way the service expects.

Response payload

{
  "challenge": "{{request.body.challenge}}"
}

Fields worth knowing

Field	What it means
challenge	Echoed straight from your request body via {{request.body.challenge}} — exactly what Slack's url_verification handshake checks for.

Create the mock

curl -X POST https://quickmock.dev/api/mocks \
  -H 'Content-Type: application/json' \
  -d '{
  "method": "POST",
  "response_status": 200,
  "content_type": "application/json",
  "response_body": "{\"challenge\":\"{{request.body.challenge}}\"}"
}'

Call it

curl -X POST -H 'Content-Type: application/json' -d '{"token":"verification-token-8f3a","challenge":"3eZbrw1aBm2rZSFEGRbdazZQb7aoEXsdMY19q6IcvKf","type":"url_verification"}' https://quickmock.dev/m/<slug>

What you get

POST the url_verification payload -> 200 echoes {"challenge":"..."} back
Slack requires this exact echo to verify the Events API endpoint

How this differs from the real thing

The request signature (the X-Slack-Signature header) isn't checked — this mock echoes the same challenge back to anyone who sends a matching body, not only to Slack itself.

Sources

FAQ

Why does Slack need the challenge echoed back?: It proves the URL is controlled by someone who can read the request body, rather than an arbitrary address someone typed in. Until the echo succeeds, Slack refuses to send any events to the endpoint.
Does it verify the Slack signature?: No. The X-Slack-Signature header is not checked, so the mock echoes the challenge back to anyone who posts a matching body. Signature verification belongs in your real handler and must be tested against Slack itself.
Will it handle real events after verification?: It will accept them and return the same echo shape, which is not what an event handler should reply. Use this template to get through verification, then point Slack at your own endpoint.

Ready to use it?

Open it in the mock builder to tweak first

Pairs well with this guide: Echo the request back

Related templates

← All templates

Last updated: 2026-10-17