Which token type is generally scoped to a single workspace installation and used for most...

A bot token represents the bot identity associated with a Slack app installed in a workspace and is the standard credential used by many Slack applications when calling Web API methods. Modern bot tokens use Slack's granular permission model, meaning their actual capabilities are determined by the bot scopes approved during installation. Bot tokens conventionally begin with `xoxb-`. They differ fundamentally from app-level tokens, which represent the application itself across installations and are limited to specific application-level functionality such as Socket Mode connectivity. A session cookie is not an application API credential. A refresh token is used when token rotation is enabled to obtain replacement access tokens rather than serving as the ordinary credential for API operations. Consequently, among the available choices, the bot token is the correct token type for routine workspace application API operations.