Third-Party Platform Login
Configure login to this system with third-party platform accounts (WeCom, DingTalk, Feishu, GitHub, Alipay, etc.). Menu: System Management → System Config → Third-Party Platforms.
The platform list is built into the system — there is no need to add a "platform"; just fill in the credentials for the platforms you use and enable them.
Page Structure (Five Tabs)
| Tab | Content |
|---|---|
| Third-party login config | Enable switches and OAuth credentials for each platform's login (card wall) |
| In-app auto login | Auto login when the system is opened in the built-in browsers of Feishu / WeCom / DingTalk |
| Alipay app config | Alipay OAuth credentials (shared by login + payment channel authentication) |
| WeChat Official Account config | Official Account credentials (web-authorization login + template notifications) |
| Douyin H5 app | Douyin open-platform H5 credentials |
Login Config (Card Wall)
Each platform has a card showing its logo, name and status (enabled / disabled / not configured). Click "Config" to open a drawer:
- Standard platforms (WeCom, DingTalk, Feishu, QQ, GitHub, Gitee, Google, etc.): fill in the client ID and client secret; WeCom also needs an app ID;
- Redirect-type platforms (Alipay, WeChat Official Account): credentials are maintained in their dedicated tabs, which the drawer reaches via a "go to credential config" shortcut;
- Standard-platform drawers show each platform's callback URLs (login and binding callbacks, one set each for the admin panel / merchant panel) — copy them into the third-party platform's console for authorization config;
- Redirect-type platform drawers show open-platform registration guidance: login and binding callbacks are uniformly relayed back to each client through the payment gateway domain, so the open platform only needs the gateway-domain information registered (for Alipay, register the "authorization callback address" — fill in the gateway's full address including the protocol, e.g.
https://gw.example.com, and enable domain-level verification on the same page; for the WeChat Official Account, register the "web authorization domain" — fill in the bare domain name without the protocol).
Configure endpoints before taking callback URLs
Callback URLs are assembled from the endpoint addresses of the platform configuration — the drawer warns when endpoints are missing, so configure them first. Redirect-type platforms additionally require the payment gateway frontend address (the entry used for callback relaying).
Why redirect-type platforms go through gateway relaying
Alipay's authorization callback address shares the same app (the same AppId) with payment authentication, and there is only one callback slot: if the login callback used the admin or merchant panel's own domain directly, it would clash with the payment callback (payment authentication would fail once login is enabled). That is why the login and binding callbacks of redirect-type platforms uniformly land on a relay path under the payment gateway domain, from which the gateway page automatically redirects back to the corresponding client — login and payment never interfere with each other.
Secret-type fields submit only the changed parts on save; unchanged secrets are not overwritten.
Platform-Level Credentials
| Tab | Fields | Serves |
|---|---|---|
| Alipay app | AppId, auth mode (public key / certificate), private key plus public key or the three certificates | Alipay authorization for third-party login + Alipay H5 authentication in payment debugging |
| WeChat Official Account | Official Account AppId, AppSecret | Official Account web-authorization login + template messages in the notification center |
| Douyin H5 | Client Key, Client Secret | H5-scenario authorization (a set of credentials independent from the "Douyin" entry in third-party login) |
In-App Auto Login
When a user opens the admin or merchant panel inside the built-in browser of the Feishu / WeCom / DingTalk client, an OAuth login is initiated automatically by matching the user agent against enabled platforms:
- Configured per client (admin panel / merchant panel) with separate switches; each picks at least one auto-login platform;
- Candidate platforms must be Feishu / WeCom / DingTalk entries that are enabled in the login config;
- The user must have bound that platform account beforehand; unbound users fall back silently to the password login page. DingTalk asks for a one-time confirmation on first authorization.
Related Links
- Personal Center — binding / unbinding third-party accounts on the user side
- Payment Platform Configuration — endpoint addresses (prerequisite of the callback URLs)
- Developer Debugging - Auth Debugging — OAuth flow verification