DingTalk Open Platform—internal apps, group bots, and approvals from the CLI.
Official & reference links
Lists all opencli dingtalk subcommands; HTTP field details follow the Open Platform docs, CLI entry points follow this page.
Overview
opencli dingtalk configures app credentials, maintains access_token, sends group robot messages, and supports ops scripts and local integration tests.
Prerequisites
| Item | Notes |
|---|
| Enterprise app on Open Platform | “Internal development” or ISV app |
| AppKey / AppSecret | From app details |
| Required API permissions | e.g. contacts read, group chat write—apply in console |
| Node.js 20+ | For opencli |
Install
npm install -g @opencli/cli@latest
opencli dingtalk --version
Configuration
Via subcommands
opencli dingtalk config set app_key dingxxxxxxxxxxxx
opencli dingtalk config set app_secret --stdin < secret.txt
set app_key: maps to AppKey.set app_secret --stdin: read secret from file to avoid process listings.
Environment variables only
export DINGTALK_APP_KEY=dingxxxxxxxxxxxx
export DINGTALK_APP_SECRET=your_secret_here
OpenCLI reads env first, then ~/.opencli/dingtalk.json.
Get access_token
opencli dingtalk auth token --print
| Behavior | Notes |
|---|
Calls https://oapi.dingtalk.com | Exchanges app_key + app_secret |
| Local cache | ~2h TTL, refreshes ~5 minutes early |
--print | Debug only; don’t log tokens in production |
Command reference (full)
opencli dingtalk --help
config
| Command | Description |
|---|
opencli dingtalk config set app_key <key> | Set AppKey |
opencli dingtalk config set app_secret --stdin | Read secret from stdin |
opencli dingtalk config set app_secret --from-env <ENV> | Read secret from env var |
opencli dingtalk config get <key> | Read one key |
opencli dingtalk config list | List all (secrets masked) |
opencli dingtalk config path | Config file path |
auth
| Command | Description |
|---|
opencli dingtalk auth token [--print] [--no-cache] | Fetch access_token |
opencli dingtalk auth token --print
message
| Command | Description |
|---|
opencli dingtalk message work-notice --userid-list <id1,id2> --msg '<json>' | Async work notification; --msg is full JSON body |
opencli dingtalk message work-notice --userid-list "10001,10002" --msg '{"msgtype":"text","text":{"content":"Deploy finished"}}'
robot
| Command | Description |
|---|
opencli dingtalk robot webhook --url <full webhook URL> --secret <signing secret> --text <body> | Signed text message |
opencli dingtalk robot webhook --url <URL> --secret <SECRET> --markdown '<json>' | Markdown (if supported) |
opencli dingtalk robot webhook \
--url "https://oapi.dingtalk.com/robot/send?access_token=XXX" \
--secret SECRET \
--text "Build succeeded: main #1024"
approval
| Command | Description |
|---|
opencli dingtalk approval get --process-instance-id <id> | Single instance |
opencli dingtalk approval list [--originator <userid>] [--limit N] [--cursor <c>] | Paginated list |
opencli dingtalk approval get --process-instance-id pi_xxxx
| Command | Description |
|---|
opencli dingtalk contact user get --userid <id> | User detail |
http (debugging)
| Command | Description |
|---|
opencli dingtalk http get <path> [--query k=v] | GET with token |
opencli dingtalk http post <path> --body '<json>' | POST with token |
- With GitHub Actions, store
DINGTALK_APP_KEY / DINGTALK_APP_SECRET as encrypted secrets.
- Allow egress to
oapi.dingtalk.com and any other domains listed in official docs.