Feishu app setup
Create one Feishu app per workspace and use it for both sign-in and notifications.
Your workspace's Feishu integration uses one self-built app for both sign-in and notifications. This page walks an organization admin through creating that app in ~5 minutes.
Before you start
- You need admin access to your organization's Feishu/Lark console (open.feishu.cn for Feishu, open.larksuite.com for Lark).
- You need owner or admin rights in the Wujie workspace that will use the app.
- Know the public URL of your Wujie deployment (e.g.
https://wujie.example.com). Feishu will only redirect to URLs you register in advance.
Create the app
Open the Feishu open platform console → Developer Console → Create app → choose Custom app (企业自建应用). Give it a name like "Wujie – your team". After creation, copy the App ID and App Secret from the app's Credentials page — you will paste them into Wujie later.
Enable the bot capability
In the app, open App capability (应用能力) → Add capability → enable Bot (机器人). Notifications are delivered by this bot in Feishu private chat.
Register the redirect URL
Open Security settings (安全设置) → Redirect URL (重定向 URL) and add:
https://YOUR-WUJIE-DOMAIN/auth/callbackThis is the single most-missed step. Without the redirect URL, Feishu rejects the sign-in authorization with a redirect_uri error. The URL must match your domain exactly — scheme, host, and path.
Grant permissions
Open Permissions & scopes (权限管理) and enable:
| Permission | Scope | Needed for |
|---|---|---|
| Get basic user info | contact:user.base:readonly | Identifying the member who signs in |
| Send messages in private chat (获取与发送单聊、群组消息) | im:message | Delivering notifications via the bot |
Publish the app
Open Version management (版本管理与发布) → Create version → submit for release. A custom app is inert until its first version is published — permissions and the bot do not take effect for organization members before that.
Connect it in Wujie
- In your workspace, open Settings → Integrations → Feishu (飞书).
- Paste the App ID and App Secret.
- Click Validate credentials — Wujie verifies the pair against Feishu before saving.
- Save, then enable the switches you need:
- Private notifications — Feishu bot delivery for mention/task events;
- Feishu sign-in — lets members sign in with Feishu.
Members who want notifications or Feishu sign-in must also bind their Feishu identity under Settings → Profile once the app is configured. Select the workspace before connecting. Then open Settings → Notifications, select the same workspace, enable personal delivery and save. Binding alone does not enable notifications.
How sign-in works
- Feishu sign-in is scoped to the workspace: members authorize against this workspace's app.
- On the login page, choose Sign in with Feishu. The browser remembers the last workspace you visited and starts the authorization against it; otherwise you are asked for the workspace identifier (the segment after the site URL's
/, e.g.acmeinhttps://wujie.example.com/acme). - Only accounts that already exist and are bound can sign in this way — there is no signup through Feishu.
Changing or removing the app
- Rotating the App Secret — save the same App ID with the new secret. Bindings keep working.
- Replacing the App ID — requires confirmation in the dialog; all Feishu identity bindings of the old app are cleared and members must re-bind.
- Deleting the configuration — both notifications and Feishu sign-in for this workspace stop working until a new app is configured.
The App Secret is encrypted at rest with the deployment's workspace-secret encryption key; it is never displayed again after saving.
The deployment administrator must configure WUJIE_WORKSPACE_SECRET_KEY (a base64-encoded 32-byte key) to encrypt workspace App Secrets. Keep this key persistent. WUJIE_LARK_SECRET_KEY belongs to the separate agent Bot integration and does not replace it.