(there are other approaches to this problem.The concept of “shoppable videos” has been around for at least a decade, with some big companies, like Showroom, Firework, Vimeo, YouTube and Klarna getting in on the action. Instead store an ID that links to that data stored on the server by your app. So depending on your security needs it would be advisable not store any user related information (especially not the access_token) in the cookie directly. Please keep in mind that cookies are stored locally on the client and can be viewed the user. (see below for a full example of what you receive from Slack)

But you will also receive a new access_token for that user (not the same as the access_token for your app) as result from a successful login. If you just want proof about a successful login it should be enough to store the team_id and user_id. What information you store about the user depends on what you application needs. Show an option for logged-in users to log out (optional).When you find the information show the user belonging to that client as logged-in (instead of showing the Slack Sign-in button).When a client opens you web page again, check the cookie of that client for information about a successful login.After a user signed in successfully, store the information about that successful login in the cookie for that client.Slack Sign-in does not cache user logins like other OAuth providers doe, so if you want to avoid that users have to sign-in every time you have to cache user permissions in your app.

No, it has nothing to do with being in the public App directory.

Slack online sign in