feat: add --no-auth flag to api command for unauthenticated requests

[WilliamBergamin]

Changelog

Allow the api command to send unauthenticated requests when no token is available or when --no-auth is specified.

Summary

Some Slack API methods (e.g. api.test, blocks.validate) don't require authentication. Previously, the api command always resolved a token and failed with an error if none was available, even when calling methods that don't need one.

This PR makes two changes:

1. Graceful fallback: if no token is found through any resolution path (flags, env vars, app prompt), the request is sent without authentication instead of erroring.
2. --no-auth flag: skips token resolution entirely. Useful in scripts or CI where you want to avoid interactive prompts and explicitly signal that no auth is needed.

The app selection prompt (shown in project directories) now includes a "No app" option, allowing users to opt out of authentication interactively.

--no-auth cannot be combined with --token or --app flags.

Preview

---

Testing

# Explicit no-auth
slack api blocks.validate --no-auth blocks='[{"type":"section","text":{"type":"mrkdwn","text":"Hello"}}]'
slack api api.test --no-auth

# Graceful fallback (no token configured, no project)
slack api api.test

Notes

None

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[codecov]

Codecov Report

❌ Patch coverage is 65.78947% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.67%. Comparing base (c693443) to head (df1e736).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/prompts/app_select.go	30.76%	7 Missing and 2 partials ⚠️
cmd/api/api.go	84.00%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #566      +/-   ##
==========================================
+ Coverage   71.66%   71.67%   +0.01%     
==========================================
  Files         226      226              
  Lines       19115    19140      +25     
==========================================
+ Hits        13699    13719      +20     
- Misses       4209     4215       +6     
+ Partials     1207     1206       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[zimeg]

@WilliamBergamin Super nice unlocks this is bringing 🔓 ✨

I'm leaving a comment on an adjacent approach we can consider? Not against having --no-auth also but think it could pair with a new app select prompt option "no app" within projects 🎲 so details on this flag or methods needing it isn't needed in scripts otherwise 👾

[zimeg]

Suggested change

	return "", nil

🔮 thought: We might want to accept no token as valid input without requiring to know which flag is needed. I realize multiple cases exist for gathering tokens and we could use --help outputs toward this. The API response I think is meaningful too:

{
    "ok": false,
    "error": "not_authed"
}

🌛 suggestion: Might adding a "no app" option to app selection perhaps support having a --no-auth flag?

  Select an app
    A0B78JUQG4U devrelsandbox T02A074M3U3
    A0B78KLUSFN tinyspek E06LPMFSSTU
+ ❱ No app

🐮 ramble: In scripts a missing --token flag might have similar results and I hope the earlier error and documentation has details toward remediation!

[WilliamBergamin]

@zimeg thanks for this awesome feedback 💯

I opted to add the "No app" option to the app selection prompt to allow users to submit a request without an app token 🚀 But I think we need to keep some sort of --no-auth flag to allow scripts and CI to bypass authentication if they need to 🤔

I did think of renaming it to --no-app, but this feels weird because the logic truly just bypasses the token resolution.

[zimeg]

@WilliamBergamin Clean implementation! This puts things in great direction for building configurations of a selection! Thanks for improving this alongside feedback suggestions 🧰 ✨

[zimeg]

🚧 suggestion: Can we import this from errors.go instead?

[zimeg]

🌟 praise: Excited for what this pattern unlocks in customizations!