web-api token should be passed in header instead of body param

[stevengill]

Description

Slack's api is dropping support in Feb 2021 for token to be passed in as a body param. We should update web-api to always pass in token via header

What type of issue is this? (place an x in one of the [ ])

• enhancement (feature request)

Requirements (place an x in each of the [ ])

• I've read and understood the Contributing guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've searched for any related issues and avoided creating a duplicate issue.

---

Packages:

Select all that apply:

• @slack/web-api

[seratch]

@stevengill I think it's great to always use Authorization header (Python & Java SDKs do so). But, just to clarify here, it's fine to use POST body params. The only thing we no longer recommend is to use querystrings.

Instead, apps must send tokens in the Authorization HTTP header or alternatively as a URL-encoded POST body parameter.
https://api.slack.com/changelog/2020-11-no-more-tokens-in-querystrings-for-newly-created-apps

[stevengill]

ooo thanks @seratch! good to know. Still worth moving to using Authorization Header since it is needed for other token types (app Token)

[filmaj]

Talking with @stevengill, need to make sure this code in socket mode client continue to work