Larkapi access credentials overview

• Access credentials access token
• How to use access credentials （access token）
• Select the appropriate access credentials （access token）

API Overview of access credentials

Last updated on 2022-05-16

To call the server API, Applications need to start from Lark Open the platform to obtain the corresponding access credentials (access token); Access credentials represent the application from the platform 、 Tenant （ Refers to the company or team ）、 Authorization obtained by the user .

To obtain with authorization Lark Open platform access credentials （access token）, You need first. Complete the following steps ：

1. The application is registered on the open platform
2. Declare the required permissions in the developer background , And release an application version
3. Users of the application （ User or tenant administrator ） Authorize the application

Access credentials access token

The open platform provides 3 There are different types of access credentials , Used to verify the identity of the caller 、 Ensure that the caller has the necessary permissions to perform the operation ： app_access_token:

application

Authorization certificate , Based on this, the open platform can identify the application identity of the caller , Applications can access information related to the application itself , It does not belong to specific enterprises or users , For example, obtain the user identity of the currently logged in application .

tenant_access_token:

Tenant

Authorization certificate , Use this access token, The application will perform corresponding operations on behalf of the company or team , For example, get the information of an address book user .

user_access_token:

user

Authorization certificate , Use this access token, The application will perform corresponding operations on behalf of the user , Such as through API Create a cloud document or an agenda .

The following are three examples of access credentials and how to obtain them ：

Access credentials	Example	Access method
app_access_token( App store app )	a-7f1bcd13fc57d46bac21793a18e560e04dcce45f	Get app access credentials
app_access_token( Enterprise self built application )	t-7f1bcd13fc57d46bac21793a18e560e04dcce45f	Get app access credentials
tenant_access_token( App store app )	t-7f1bcd13fc57d46bac21793a18e560e04dcce45f	Obtain tenant access credentials
tenant_access_token( Enterprise self built application )	t-7f1bcd13fc57d46bac21793a18e560e04dcce45f	Obtain tenant access credentials
user_access_token	u-7f1bcd13fc57d46bac21793a18e560e04dcce45f	Get user access credentials

How to use access credentials （access token）

Different API One or more of the above access credentials may be supported （access token） As API Authentication means when calling . API Invocation time , Need to put access token Put in the request Header in , Use the syntax Authorization:Bearer <access token> To call . Here is a call API Inquire about Get the list of users An example of , It should be noted that , In the example access_token need Replace For valid access credentials （access token）.

$curl --request GET 'https://open.feishu.cn/open-apis/contact/v3/users' \
--header 'Content-Type: application/json; charset=utf-8' \
--header 'Authorization:Bearer < Actually  access token>'

Corresponding HTTP Request content ：

GET /open-apis/contact/v3/users HTTP/1.1
Host: open.feishu.cn
Content-Type: application/json;charset=utf-8
Authorization: Bearer < Actually  access token>

Select the appropriate access credentials （access token）

Different access token Represents different resource access rights , Different API May support one or more of the above access token access . Call the same API, Use different access token Different data will be obtained .

• user_access_token： Users need to log in or authorize applications , Applications can perform related operations as users , Data range accessed 、 The operations that can be performed will be affected by the permissions of the user
• tenant_access_token perhaps app_access_token： Authorized by the administrator , The application uses its own identity for related operations , Data range accessed 、 The operations that can be performed will be affected by the data permissions of the application itself

You need to choose the right one according to the application scenario access token, Here are the differences access token stay Under the main scenario The difference between .

Access credential type	Whether user authorization is required	Whether the tenant administrator authorization is required	Applicable application scenarios
app_access_token	Unwanted	Unwanted	Pure background services, etc
tenant_access_token	Unwanted	need	Web applications 、 robot 、 Pure background services, etc
user_access_token	need	Unwanted	Applet 、 Web application, etc