WeChat Mini Program access token configuration API-Quick Audience(Quick Audience)-阿里云帮助中心

Overview

Configure the access token before sending WeChat Mini Program subscription notifications. Your API must implement:

Retrieve the WeChat Mini Program access token. A request parameter specifies whether to refresh the token. Ensure the token remains valid.
Connectivity test. After configuration, Quick Audience runs a connectivity test without passing a wxAppId (the WeChat Mini Program AppId). Return a response with status code 200 and an empty token.

Parameters

Parameter	Description	Notes
URL	Your endpoint URL for retrieving the WeChat token.	Your API developer must provide this endpoint with the features described above.
APP ID	Parameter used for signature verification.	Get this value from your API developer.
AccessKey	Parameter used for signature verification.	Get this value from your API developer.
SecretKey	Parameter used for signature verification.	Get this value from your API developer.

API reference

API description	Query the WeChat Mini Program access token
URL	${customer_provided_url}?appId=aaa&accessKey=xxx&timestamp=yyy
Request method	POST
Request type	application/json
Response type	/
Parameter	Data type	Parameter type	Required	Description
wxAppId	string	body	Yes	The AppId of the WeChat Mini Program.
refresh	boolean	body	Optional	Specifies whether to refresh the token. Default: false.
Status code	Description		Notes
200	OK		The request was successful.
401	Unauthorized		The request is not authorized.
403	Forbidden		The request was denied.
404	Not Found		The requested resource does not exist.
Response field	Type		Description
1. Code	string		The request status code. A value of 200 or OK indicates success.
2. Message	string		The error message.
3. Access token	string		The access token of the WeChat Mini Program.
4. expireTime	DateTime		The expiration time. Format:
4. Request ID	string		The request ID.
Example
Request parameter	http://{URL_to_get_token}?appId=aaa&accessKey=xxx&timestamp=yyy
Return value	{"code":"200","requestId":"string","message":"string","accessToken":"xxxx","expireTime":"2024-09-10 00:00:00"}

Signature verification

Quick Audience generates signatures using the following method. Your application must use the same method to verify signatures.

Quick Audience includes appId, accessKey, and timestamp in the query string. The Authorization signature is added to the request header.

Common parameters

Parameter	Description	Location
appId	The application ID from the Open Platform.	In the query string of the request URI.
accessKey	The AccessKey of the application from the Open Platform.	In the query string of the request URI.
timestamp	The current UNIX timestamp in seconds.	In the query string of the request URI.
Authorization	The generated signature.	In the request header.

Signature generation rules

Use the request parameters to construct a canonicalized query string.
Sort all request parameters alphabetically by name, including both common and API-specific parameters. For GET requests, these are the query string parameters (after the ? in the URI, separated by &).
URL-encode the parameter names and values using the UTF-8 character set.

Code example

Java example for signature generation:

String appId="tttt";
String accessKey = "xxxx";
String accessSecret ="yyyy";
String timeStamp = "1708235644862";

SortedMap<String, String> map = new TreeMap<>();
map.put("appId", appId);
map.put("accessKey", accessKey);
map.put("accessSecret",accessSecret );
map.put("timestamp", timeStamp);
// If it is a GET request with other query parameters, add them here.

String canonicalString = getCanonicalQueryString(map);
System.out.println(canonicalString);
String authorization = org.apache.commons.codec.digest.DigestUtils.md5Hex(canonicalString);
System.out.println(authorization);

public static String getCanonicalQueryString(SortedMap<String, String> paramsMap) {
        StringBuilder queryString = new StringBuilder();
        boolean isFirstParameter = true;

        for (Map.Entry<String, String> entry : paramsMap.entrySet()) {
            String paramName = entry.getKey();
            String value = entry.getValue();

            if (!isFirstParameter) {
                queryString.append("&");
            } else {
                isFirstParameter = false;
            }
            queryString.append(paramName).append("=").append(value);
        }
        return queryString.toString();
}

Example:

curl --location -g --request POST 'http://{configured_URL_for_token_retrieval}?appId=aaa&accessKey=xxx&timestamp=yyy' \
--header 'Authorization: demosign'

Error codes

Error code	Error message	Description
ES05910010001	App does not exist.	Verify that the application exists on the Open Platform.
ES05910010002	Incorrect signature.	Verify that the signature was generated correctly.
ES05910010003	Timestamp validation failed.	The API must be called within 3 minutes of the timestamp generation. Otherwise, validation fails.
ES05910010004	The application does not have permission for this API.	The application must subscribe to the API to use it.
ES05910010005	Verify that the appId, accessKey, and timestamp parameters are passed correctly.	appId, accessKey, and timestamp are required for all Open Platform APIs. Verify these parameters match the platform specifications.