# DingTalk login integration

Configure a DingTalk internal enterprise application so pre-imported members can sign in to AskTable from the DingTalk client.

使用指南 · 模块: integrations · 管理人员 · 部署形态：Cloud / 私有部署 · 已确认产品版本：资料未说明 · 来源：编辑整理 · 变更章节按产品 4.2.48-1026 核对（CLI 命令另按 0.0.10）；不代表所有实例已升级，也不是完整历史支持矩阵。

An organization Owner or Admin can connect a DingTalk application and import employees allowed to sign in. These steps were checked against product `4.2.48-1026`; confirm the version of older instances first.

## Prepare the application and permissions

Create an internal enterprise application in the DingTalk developer console, enable web application support, and obtain these credentials:

| AskTable field | Value                                                                                                             |
| -------------- | ----------------------------------------------------------------------------------------------------------------- |
| CorpID         | The CorpID of the application's enterprise, available in enterprise information on the developer console homepage |
| Client ID      | Formerly AppKey / SuiteKey                                                                                        |
| Client Secret  | Formerly AppSecret / SuiteSecret; enter the complete value                                                        |

All credentials must come from the same internal enterprise application. App ID and AgentId on the application credentials page are not CorpID, and the current organization login integration does not require those two fields.

Enable these four permissions in application permission management, include the departments and members to import in the authorized scope, then submit and publish the application version:

- `qyapi_get_department_member`
- `qyapi_get_member`
- `qyapi_get_department_list`
- `Contact.User.Read`

The AskTable configuration page's **Application configuration → Permission configuration → Required permissions** lets you view and copy each permission code. Login uses the enterprise's `userid`; phone number and email permissions are not required.

## Connect AskTable

Open **Personal settings → Login integrations → DingTalk**, click **Enable**, and enter CorpID, Client ID, and the complete Client Secret. Do not enter a masked secret. CorpID cannot be changed directly after saving; disconnect before switching enterprises.

Copy the complete login URL from the details page into the DingTalk web application's PC and mobile homepages. Configure trusted domains and the server's outbound IP as required by the DingTalk console, then publish the application.

- A private deployment URL looks like `https://your-domain/login/sso/dingtalk`, without an organization parameter.
- A Cloud URL includes `?org_id=...`, which must be preserved in full.
- If the deployment has a path prefix, use the complete URL shown on the page.

Currently, only automatic sign-in inside the DingTalk client is supported, identifying employees through a micro-application authorization code. Browser QR-code login is not used.

## Import and verify members

Click **Import members** on the AskTable DingTalk details page, select people within the application's visibility scope, and submit. Then open the application from the DingTalk workplace as an imported member.

First login does not create an account automatically. Both the AskTable account and organization membership must be active; importing again does not restore disabled members. Importing the same employee from DingTalk, Feishu, or WeCom creates separate accounts that consume separate seats, without merging by phone number or email.

Automatic address book synchronization and automatic offboarding are currently unavailable. Disconnecting retains accounts, members, and project history; see [Enterprise integration login](https://docs.asktable.com/en/organization/enterprise-login). After importing, still assign [project roles](https://docs.asktable.com/en/organization/invitations) and [data permissions](https://docs.asktable.com/en/permissions).

## Troubleshooting

| Symptom                                      | Check                                                                                                                                                  |
| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Cannot read import candidates                | Client ID, Client Secret, address book API permissions, and authorized personnel scope                                                                 |
| Automatic sign-in fails                      | Whether CorpID matches the application's enterprise, application homepage and publication status, and whether it was opened inside the DingTalk client |
| Identity is recognized but login is rejected | Whether the member was imported and whether the AskTable account and organization membership are active                                                |