Stop Copy-Pasting WeCom OAuth Snippets — There's an SDK for That Now
If you've ever had to add WeCom (WeChat Work / 企业微信) login to an application, you know the ritual: Search for blog posts in Chinese. Copy a Python or JavaScript snippet from 2019. Patch it until the redirect stops breaking. Discover in production that some users get an OpenId instead of a UserId and your code returns null . I went through that loop enough times to decide the plumbing should be a…
Adding WeCom (WeChat Work) login to applications can be a frustrating process. Copying and pasting outdated snippets from Chinese blog posts often leads to issues such as redirect failures, OpenID instead of UserId, and null returns. This is why the wecompass package was created: a TypeScript SDK for WeCom OAuth2 and the most common qyapi endpoints.
To use the SDK, first import WeComClient and build the authorize URL. Proper URL encoding is crucial, especially for redirect URIs with query parameters. The SDK handles this properly. Next, exchange the authorization code for identity. Be aware that with snsapi_base scope, WeCom returns an OpenId for users outside the application's visible range. The SDK takes care of token management by caching, refreshing, and retrying access tokens.
For PC users, the SDK can also build the QR code for desktop login. While the SDK handles most of the OAuth2 flow, two application-specific concerns need to be addressed: state validation and the session layer. The SDK validates the state parameter, but developers must still implement CSRF protection by comparing the state against a stored value before the redirect.
The SDK provides identity information, but issuing JWTs, cookies, or sessions is up to the application's architecture. Lastly, developers should keep the signing key for sessions fixed across restarts to avoid logging out every user with each deploy.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
