AppFlow WeCom authentication

Before you begin

1. To obtain the WeCom Corp ID, see View the CorpId.

2. To obtain the app's AgentId and Secret, see How to obtain the AgentId.

Create a credential

1. Sign in to the AppFlow console and click Create Credential.

2. Configure the basic information.

   1. For Connector Type, select Public Connector . For Connector, select WeCom. Enter a custom Credential Name.

   2. Enter the Corp ID, AgentId, and Secret from the "Before you begin" section.

   3. Take note of the generated Token and EncodingAESKey. Click Next step.

      Example:

      Token: z3REUKlEPkoXDYnZaWhTAW7NK****

      EncodingAESKey: FYwixZLcmwDROiDp3O7CMpJq7Y4ZOS7JevL0IE3****

      Note

      Save the Token and EncodingAESKey. You must enter them later on the API callback page.

      Important

      Save the IP address whitelist. You must add it later to the app’s Trusted IPs in WeCom.

3. Configure an intranet proxy (Optional).

   Note

   If you have issues with trusted domain names or cannot add trusted IPs, click Intranet Proxy to configure it. Otherwise, save the configuration directly.

   1. The first time you select Intranet Proxy, AppFlow prompts you to authorize a service-linked role. Grant the authorization.

   2. AppFlow provides the following three options for domain name or IP configuration.

      Compute Nest instance

      If you lack a trusted domain name filed with Alibaba Cloud or an Nginx proxy, use Compute Nest to automatically deploy and configure an Nginx proxy.

      1. Click Deploy Nginx Proxy Instance.

      2. On the Deploy Nginx Proxy Instance page, configure the parameters based on your business scenario and click Next: Confirm Order.

      3. Confirm the parameters and billable items of the service instance, and then click Create Now.

         Note

         The deployment takes about 1 to 3 minutes. Refresh the list to check when the process is complete.

      4. From the drop-down list, select the Compute Nest instance, copy the IP address whitelist, and click Save.

         Important

         Save the IP address whitelist. You must add it later to the app’s Trusted IPs in WeCom.

      Trusted domain name

      1. Select an ECS instance or a managed instance for forwarding.

         If you do not have an instance, click Add Instance to purchase an ECS instance or create a managed instance.

         Note

         For a managed instance, you must have a machine outside Alibaba Cloud with public internet access and install Cloud Assistant on it. For instructions, see Alibaba Cloud managed instances.

         Important

         Save the IP address whitelist. You must add it later to the app’s Trusted IPs in WeCom.

      2. Click Next step to add or select your trusted domain name.

      If you have not added your domain name in AppFlow, click Add Domain Name and follow the prompts.

      After you add the domain name, the system generates a CNAME record. Configure DNS resolution as prompted.

      1. Click Save to complete the configuration.

      Custom Nginx proxy

      Use your own Nginx proxy. You also need an ECS instance or a managed instance for message forwarding.

      1. Select an ECS instance or a managed instance for forwarding.

         If you do not have an instance, click Add Instance to purchase an ECS instance or create a managed instance.

         Note

         For a managed instance, you must have a machine outside Alibaba Cloud with public internet access and install Cloud Assistant on it. For instructions, see Alibaba Cloud managed instances.

         Important

         Save the IP address whitelist. You must add it later to the app’s Trusted IPs in WeCom.

      2. Click Save to complete the configuration.

Create a connector flow

Create a connector flow with the new credential to get the URL for the WeCom callback server. This section outlines the main steps. For more information, see Create a connector flow.

1. In the Public Connector section, select WeCom.

2. Select Trigger Event based on your business scenario and click Save and Go to Next. This topic uses When a text message is received as an example.

3. For Connection Credential, select the credential you created, and then click Save and Go to Next.

4. Select an execution action based on your business scenario, follow the prompts to complete the connector flow configuration, and click Save to create the flow.

5. In the connector flow list, find the connector flow that you created and click Operation in the Details column.

6. In the connector flow details, click View next to View.

   Click Copy to save the webhookUrl. Example: https://15634578xxxxxx8522.appflow.aliyunnest.com/webhook/a479axxxxxxxc99

Configure WeCom

1. Sign in to WeCom, go to the Application Management page, and select your custom app.

2. Configure Set API Callback.

   1. On your app's page, in the Receive messages section, click Set API Callback.

   2. On the API callback page, enter the saved webhookUrl, Token, and EncodingAESKey into their corresponding fields, and then click Save.

   3. The API callback page displays the configured URL, Token, and EncodingAESKey in read-only mode, with Edit and Delete options on the right.

3. Configure Trusted IPs.

   1. Return to your app's page and click Configure in the Trusted IPs section.

   2. In the Trusted IPs section, enter the IP address whitelist that you saved when you created the credential, and click OK.

      • If you did not configure an intranet proxy, see IP address whitelist.

        In the Trusted IPs dialog box, enter all IP addresses from the whitelist, separated by semicolons, and click OK.

      • If you did configure an intranet proxy, see the intranet proxy IP address whitelist.

        In the Trusted IPs dialog box, enter the IP address whitelist for the intranet proxy and click OK.