DingTalk app setup

Create one DingTalk internal app per workspace and use it for both sign-in and notifications.

Your workspace's DingTalk integration uses one enterprise internal app (企业内部应用) for both sign-in and notifications. This page walks an organization admin through creating that app on the DingTalk open platform.

DingTalk internal apps only authorize members of your own organization — exactly the isolation a per-workspace app needs. Each Wujie workspace brings its own app; members sign in against their own org's app.

Before you start

You need developer/admin access in your organization's DingTalk admin console (open.dingtalk.com).
You need owner or admin rights in the Wujie workspace that will use the app.
Know the public URL of your Wujie deployment (e.g. https://wujie.example.com). DingTalk will only redirect to URLs you register in advance.

Create the app

Open the DingTalk open platform console → App Developer Console (开发者后台) → Create app. Give it a name like "Wujie – your team". After creation, copy the Client ID (AppKey / SDKAppID) and Client Secret (AppSecret) from the app's Credentials page — you will paste them into Wujie later.

In the app:

Sign-in and sharing (登录与分享) — enable QR login (扫码登录) for the web authorization flow, and register the redirect URL (next step).
App capability (应用能力) — add Robot (机器人). Notifications are delivered by this robot in DingTalk private chat. Note the robot code (robotCode); Wujie asks for it when enabling notifications.

Register the redirect URL

In Sign-in and sharing (登录与分享) → Redirect URLs (回调域名/重定向 URL) add:

https://YOUR-WUJIE-DOMAIN/auth/callback

This is the single most-missed step. Without the redirect URL, DingTalk rejects the sign-in authorization with a redirect error. The URL must match your domain exactly — scheme, host, and path.

Grant permissions

Open Permission management (权限管理) and enable the contact scopes needed to identify the signing-in member (for example 读取通讯录基础信息 / Contact.User.Read along with the default openid corpid OAuth scopes). Robot message delivery uses the app access token and needs no extra user-level scopes.

Publish the app

Submit the app for release in your organization's admin console. Depending on your org's settings, an internal app may need admin approval before members can authorize it.

Connect it in Wujie

In your workspace, open Settings → Integrations → DingTalk (钉钉).
Paste the App Key (Client ID) and App Secret.
Save — Wujie probes the credentials against your org before storing them, which proves the app belongs to your organization.
Enable the switches you need:
- Workspace notifications (通知开关) — switches this workspace from the legacy account-level channel to your own app for robot DMs;
- QR sign-in (登录开关) — lets members sign in with DingTalk against this app.

Members who want notifications or DingTalk sign-in must also bind their DingTalk identity under Settings → Profile once the app is configured. The binding applies to the current workspace. Then open Settings → Notifications, enable personal delivery and save. Binding alone does not enable notifications.

DingTalk sign-in is scoped to the workspace: members authorize against this workspace's app, and DingTalk only lets your own organization's members through.
On the login page, choose Sign in with DingTalk. The browser remembers the last workspace you visited and starts the authorization against it; otherwise you are asked for the workspace identifier (the segment after the site URL's /, e.g. acme in https://wujie.example.com/acme).
Only accounts that already exist and are bound can sign in this way — there is no signup through DingTalk.
One DingTalk account can be bound once per workspace: if you are a member of two workspaces run by two different organizations, bind in each workspace with that organization's app.

Changing or removing the app

Rotating the App Secret — save the same App Key with the new secret. Bindings keep working.
Replacing the App Key — requires confirmation in the dialog; DingTalk identity bindings of the old app are cleared and members must re-bind.
Deleting the configuration — both notifications and DingTalk sign-in for this workspace stop until a new app is configured.

The App Secret is encrypted at rest with the deployment's workspace-secret encryption key (WUJIE_WORKSPACE_SECRET_KEY); it is never displayed again after saving. Keep that deployment key persistent — rotating it makes stored secrets unreadable.

DingTalk app setup

Create one DingTalk internal app per workspace and use it for both sign-in and notifications.

Before you start

You need developer/admin access in your organization's DingTalk admin console (open.dingtalk.com).
You need owner or admin rights in the Wujie workspace that will use the app.
Know the public URL of your Wujie deployment (e.g. https://wujie.example.com). DingTalk will only redirect to URLs you register in advance.

Create the app

In the app:

Sign-in and sharing (登录与分享) — enable QR login (扫码登录) for the web authorization flow, and register the redirect URL (next step).
App capability (应用能力) — add Robot (机器人). Notifications are delivered by this robot in DingTalk private chat. Note the robot code (robotCode); Wujie asks for it when enabling notifications.

Register the redirect URL

In Sign-in and sharing (登录与分享) → Redirect URLs (回调域名/重定向 URL) add:

https://YOUR-WUJIE-DOMAIN/auth/callback

This is the single most-missed step. Without the redirect URL, DingTalk rejects the sign-in authorization with a redirect error. The URL must match your domain exactly — scheme, host, and path.

In your workspace, open Settings → Integrations → DingTalk (钉钉).
Paste the App Key (Client ID) and App Secret.
Save — Wujie probes the credentials against your org before storing them, which proves the app belongs to your organization.
Enable the switches you need:
- Workspace notifications (通知开关) — switches this workspace from the legacy account-level channel to your own app for robot DMs;
- QR sign-in (登录开关) — lets members sign in with DingTalk against this app.

DingTalk sign-in is scoped to the workspace: members authorize against this workspace's app, and DingTalk only lets your own organization's members through.
On the login page, choose Sign in with DingTalk. The browser remembers the last workspace you visited and starts the authorization against it; otherwise you are asked for the workspace identifier (the segment after the site URL's /, e.g. acme in https://wujie.example.com/acme).
Only accounts that already exist and are bound can sign in this way — there is no signup through DingTalk.
One DingTalk account can be bound once per workspace: if you are a member of two workspaces run by two different organizations, bind in each workspace with that organization's app.

Changing or removing the app

Rotating the App Secret — save the same App Key with the new secret. Bindings keep working.
Replacing the App Key — requires confirmation in the dialog; DingTalk identity bindings of the old app are cleared and members must re-bind.
Deleting the configuration — both notifications and DingTalk sign-in for this workspace stop until a new app is configured.

DingTalk app setup

Before you start

Create the app

Register the redirect URL

Grant permissions

Publish the app

Connect it in Wujie

Changing or removing the app

On this page

DingTalk app setup

Before you start

Create the app

Register the redirect URL

Grant permissions

Publish the app

Connect it in Wujie

Changing or removing the app

On this page