"token" header parameter not actually required

[krissirk]

Description

“token” is designated as a required header parameter for many methods in the OpenAPI spec for the Web API (e.g. "operationId": "chat_postMessage"), but this input behaves as optional and is not actually needed when a request is made with a valid token for Authorization: Bearer. Please update the spec to ensure any occurrence of the header parameter of name "token" is properly designated as true or false...and included in the spec conjunction with the Authorization header behavior.

What type of issue is this? (place an x in one of the [ ])

• bug
• enhancement (feature request)
• question
• documentation related
• testing related
• discussion

Requirements (place an x in each of the [ ])

• I've read and understood the Contributing guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've searched for any related issues and avoided creating a duplicate issue.

---

Bug Report

Filling out the following details about bugs will help us solve your issue sooner.

Reproducible in:

Development environment:

Steps to reproduce:

Both of the following calls work, proving that the token parameter is not required:
/* No token parameter */
curl --location --request POST 'https://slack.com/api/chat.postMessage'
--header 'Content-Type: application/x-www-form-urlencoded'
--header 'Authorization: Bearer xoxb-'
--data-urlencode 'channel='
--data-urlencode 'as_user=1'
--data-urlencode 'text=hello'

/* Invalid token parameter */
curl --location --request POST 'https://slack.com/api/chat.postMessage'
--header 'token: garbage'
--header 'Content-Type: application/x-www-form-urlencoded'
--header 'Authorization: Bearer xoxb-'
--data-urlencode 'channel='
--data-urlencode 'as_user=1'
--data-urlencode 'text=hello'

Expected result:

If the token header parameter is actually required, I'd expect both of the above requests to fail.

Actual result:

Both requests succeed

Attachments:

Logs, screenshots, screencast, sample project, funny gif, etc.
If attaching logs, please remove user data and tokens.