Skip to main content

Use cases

This API gets the user’s accessToken and is a key step in implementing user identity authentication. Common use cases include:
  • After a user signs in, exchange the authorization code (code) for a valid access credential.
  • Before the accessToken expires, use the refreshToken to renew it automatically and avoid frequent re-authorization.
  • A third-party enterprise app integrates with the DingTalk unified sign-in system to implement single sign-on (SSO).
  • An enterprise app calls protected APIs on behalf of a user from its backend service.
Developers should properly manage the lifecycle of the accessToken. We recommend caching it locally and setting up an automatic refresh mechanism to ensure stable API calls.
When using the access token, note the following:
  • The accessToken is valid for 7,200 seconds (2 hours). Repeated requests within the validity period return the same result and automatically renew it. After expiration, a new accessToken is returned.
  • Each app’s accessToken is independent. Cache the token by app to avoid confusion.

Request

Request body

Request example

Java
Python
PHP
Go
Node.js
C#
C

Response

Response body

Response example

Error codes

If an error occurs when calling this API, find the solution by error message in the Error codes (legacy Server-side) document.