DingTalk login integration

An organization Owner or Admin can connect a DingTalk application and import employees allowed to sign in. These steps were checked against product 4.2.48-1026; confirm the version of older instances first.

Prepare the application and permissions

Create an internal enterprise application in the DingTalk developer console, enable web application support, and obtain these credentials:

All credentials must come from the same internal enterprise application. App ID and AgentId on the application credentials page are not CorpID, and the current organization login integration does not require those two fields.

Enable these four permissions in application permission management, include the departments and members to import in the authorized scope, then submit and publish the application version:

• qyapi_get_department_member
• qyapi_get_member
• qyapi_get_department_list
• Contact.User.Read

The AskTable configuration page's Application configuration → Permission configuration → Required permissions lets you view and copy each permission code. Login uses the enterprise's userid; phone number and email permissions are not required.

Connect AskTable

Open Personal settings → Login integrations → DingTalk, click Enable, and enter CorpID, Client ID, and the complete Client Secret. Do not enter a masked secret. CorpID cannot be changed directly after saving; disconnect before switching enterprises.

Copy the complete login URL from the details page into the DingTalk web application's PC and mobile homepages. Configure trusted domains and the server's outbound IP as required by the DingTalk console, then publish the application.

• A private deployment URL looks like https://your-domain/login/sso/dingtalk, without an organization parameter.
• A Cloud URL includes ?org_id=..., which must be preserved in full.
• If the deployment has a path prefix, use the complete URL shown on the page.

Currently, only automatic sign-in inside the DingTalk client is supported, identifying employees through a micro-application authorization code. Browser QR-code login is not used.

Import and verify members

Click Import members on the AskTable DingTalk details page, select people within the application's visibility scope, and submit. Then open the application from the DingTalk workplace as an imported member.

First login does not create an account automatically. Both the AskTable account and organization membership must be active; importing again does not restore disabled members. Importing the same employee from DingTalk, Feishu, or WeCom creates separate accounts that consume separate seats, without merging by phone number or email.

Automatic address book synchronization and automatic offboarding are currently unavailable. Disconnecting retains accounts, members, and project history; see Enterprise integration login. After importing, still assign project roles and data permissions.

Troubleshooting