Fix: Slack “Link Preview” not generating for Internal Sites

When you paste an internal link (such as an intranet portal, staging server, private wiki, or self-hosted Git repository) into Slack and no rich preview appears, Slack is not malfunctioning. Slack generates link previews by dispatching automated cloud scrapers to fetch the page’s Open Graph metadata. Because these scrapers run on Slack’s external cloud servers, they cannot reach private network addresses, traverse corporate VPNs, or bypass internal single sign-on (SSO) gateways.

Fast Fix

Slack’s cloud scrapers cannot access private intranet IP addresses (such as 10.x.x.x or 192.168.x.x) or sites behind private VPNs. To generate link previews for internal tools, install the tool’s official Slack app (such as Jira, GitHub, or Confluence) or build an internal Slack app using the link_shared Events API to provide authenticated previews.

---

Diagnostic Snapshot

• Symptom: Pasting a URL generates a plain clickable text link, but no rich card, page title, summary text, or thumbnail image renders.
• Underlying Architecture: Slack’s external cloud scraper (Slackbot-LinkExpanding) cannot reach private RFC 1918 networks.
• Authentication Barrier: Internal sites that require corporate SSO (Okta, Microsoft Entra ID) return HTTP 302 redirects or 401/403 access denials to Slack’s scraper.
• Scope: All links pointing to internal, non-publicly routable infrastructure.

---

How Slack Link Unfurling Functions

Understanding how link previews work clarifies why private URLs fail to expand:

[User pastes internal URL]
           │
           ▼
[Slack Desktop Client] ──────► [Slack Cloud Server]
                                       │
                        (Attempts to scrape the URL)
                                       │
                                       ▼
                       [Corporate Firewall / Private DNS]
                                       │
                      Can Slackbot reach the endpoint?
                             /                  \
                           YES                   NO
                           /                      \
             [Public Web Page]            [Internal Intranet / Staging]
          Parses Open Graph Tags.        • Private IP (10.x.x.x): UNREACHABLE
          Renders rich preview.          • Behind SSO: Returns 302 Login Page
                                         • Result: Plain text link only

1. User Action: You paste https://wiki.corp.internal/page/123 into a Slack channel.
2. Server-Side Scraping: Slack’s external backend servers, not your local computer, attempt an HTTP GET request to that address using the user-agent Slackbot-LinkExpanding.
3. The Network Wall: Even if your laptop is connected to your corporate VPN, Slack’s cloud servers are not. The request fails because the domain either does not exist on public DNS or resolves to a non-routable private IP address.
4. The Authentication Wall: If your internal tool is hosted on a public domain but protected by identity-aware proxies (such as Cloudflare Access or Okta), Slack’s scraper receives an authentication challenge instead of the page’s HTML headers, and the preview is aborted.

---

Step-by-Step Resolution & Workarounds

Step 1: Verify Client-Side Preview Settings

Before changing developer configurations, verify that link previews are not disabled in your user preferences:

1. In Slack, click your profile picture and go to Preferences.
2. Select Messages & media.
3. Under Inline media & links, verify that both Show images and media from websites and Show a preview of each website that you link to are checked.
4. If these options are grayed out, an enterprise policy has disabled them globally. For information on policy restrictions, see How to Resolve: Slack “Integrations” grayed out (Policy Block).

Step 2: Use Official Vendor Apps for Internal SaaS Tools

If the internal URL points to an enterprise tool (such as Jira, Confluence, GitHub Enterprise, or Google Drive):

1. Do not rely on plain web scraping.
2. Install the vendor’s dedicated Slack integration from the Slack App Directory.
3. These applications use OAuth tokens granted by individual users. When a link is shared, the app intercepts the link, queries the vendor API securely using authorized credentials, and formats an authenticated rich card directly in Slack.

Step 3: Implement Authenticated Previews with the link_shared API

For proprietary, custom-built internal portals that you want Slack to expand:

1. Go to api.slack.com/apps and create an internal Slack App for your workspace.
2. Enable Event Subscriptions and subscribe to the link_shared event.
3. Register your internal domain (e.g., wiki.yourcompany.com) under the app’s App Unfurl Domains.
4. When a user pastes a registered domain, Slack sends a JSON payload containing the URL and message context to your application server.
5. Your internal server, which sits safely inside your corporate network, extracts the title and description, then calls Slack’s chat.unfurl API endpoint to attach the rich preview back to the original message.

Step 4: Verify Missing Open Graph Tags on Publicly Accessible Staging Sites

If the website is publicly accessible without VPN or login screens, but still fails to unfurl:

1. Inspect the target site’s HTML <head> markup using a browser’s developer tools.
2. Confirm the presence of basic Open Graph metadata tags:
   • <meta property="og:title" content="Page Title" />
   • <meta property="og:description" content="Brief summary" />
3. If the page relies entirely on client-side single-page application (SPA) rendering (such as React or Angular) to inject title tags via JavaScript, Slackbot will not see them. Slack’s crawler does not execute complex JavaScript bundles; it reads the raw initial HTML response.

---

Security Notice: Never Expose Internal Endpoints Openly

Do not open internal development or intranet servers to the public internet solely to make Slack link previews work. Exposing unprotected endpoints bypasses internal network firewalls. Always use the authorized link_shared Events API pattern or official enterprise integration apps to manage link unfurling securely.