# Feishu login integration

Configure a Feishu enterprise application so pre-imported members can sign in to AskTable from the Feishu client.

使用指南 · 模块: integrations · 管理人员 · 部署形态：Cloud / 私有部署 · 已确认产品版本：资料未说明 · 来源：编辑整理 · 变更章节按产品 4.2.48-1026 核对（CLI 命令另按 0.0.10）；不代表所有实例已升级，也不是完整历史支持矩阵。

Feishu login identifies organization members. It is configured separately from the [Feishu bot](https://docs.asktable.com/en/integrations/feishu) and [Feishu workbook](https://docs.asktable.com/en/data/connect); enabling one does not enable the others. These steps were checked against product `4.2.48-1026`; confirm the version of older instances first.

## Prepare the application

1. Create an enterprise application in the Feishu developer console, enable web application support, and obtain its **App ID** and **App Secret**.
2. As an AskTable organization Owner or Admin, open **Personal settings → Login integrations → Feishu**, click **Enable**, and enter the credentials.
3. Click **Copy permission JSON** under **Permission configuration** on the details page. Import it through **Batch processing → Batch import/export permissions** in Feishu permission management. After saving the configuration, **Open Feishu permission management** also opens the corresponding application.
4. Include the departments and members to import in the address book visibility scope, then publish the application version to activate its permissions. If authorization uses user groups, also enable `contact:group:readonly`.

Login uses the application's `open_id`; phone number, email, and employee `user_id` permissions are not required. If member names are missing, check that the basic member profile permission has been published and activated.

App ID cannot be changed directly after saving; disconnect before switching applications. Saving does not import members automatically or prove that the external credentials have been verified.

## Configure the login URL

Copy the complete login URL from the AskTable details page into the Feishu web application's desktop and mobile homepages, and configure the AskTable domain as trusted. Select opening inside the Feishu client.

- A private deployment URL looks like `https://your-domain/login/sso/feishu`, without an organization parameter.
- A Cloud URL includes `?org_id=...`, which must be preserved in full.
- If the deployment has a path prefix, use the complete URL shown on the page.

Currently, automatic sign-in only works when opening the application from the Feishu client's workplace. A regular browser entry asks the user to use the Feishu client.

## Import and verify members

Click **Import members** on the AskTable Feishu details page, select people within the application's visibility scope, and submit. Then open the application from the Feishu workplace as an imported member and confirm that it enters the correct organization.

First login does not create an account automatically. Both the account and organization membership must be active; importing again does not restore disabled members. Importing the same employee from Feishu, WeCom, or DingTalk creates separate AskTable accounts that each consume a seat. Matching phone numbers or email addresses do not merge them.

Scheduled address book synchronization and automatic offboarding are currently unavailable. Disconnecting retains accounts, members, and project history. See [Enterprise integration login](https://docs.asktable.com/en/organization/enterprise-login) for the full rules. After importing, still assign [project roles](https://docs.asktable.com/en/organization/invitations) and [data permissions](https://docs.asktable.com/en/permissions).

## Troubleshooting

| Symptom                                      | Check                                                                                                                                  |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Cannot read import candidates                | Application credentials, address book permissions, visibility scope, and application publication status                                |
| Automatic sign-in fails                      | Application homepage, trusted domain, and whether it was opened inside the Feishu client                                               |
| Identity is recognized but login is rejected | Whether the member was imported, whether the account and organization membership are active, and whether the Cloud URL retains org\_id |