## Overview
Feishu (Lark) server APIs authenticate either as the app (tenant_access_token) or as a user (user_access_token). Integration workloads almost always use the app identity: an internal app posts app_id and app_secret to this endpoint and receives a tenant_access_token plus expire (about 7200 seconds). Subsequent calls carry Authorization: Bearer {tenant_access_token}.
### Steps
1. Create an internal app in the Feishu developer console and note the App ID/App Secret.
2. Enable the required scopes under Permissions (e.g. approval:approval, contact:user.base:readonly) and publish an app version — scope changes only take effect after publishing.
3. Exchange for the token, cache it locally and refresh before expiry.
4. Send the Bearer token on every business call; non-zero code responses come with msg and are documented in the Feishu error-code reference.
### Notes
- An expired tenant token returns error 99991663; the integration layer should catch it, refresh and replay instead of failing the task.
- app_secret is only for token exchange and must never appear on business calls; rotate it in the console if leaked.
- The international Lark deployment lives on open.larksuite.com with identical paths — switch domains for overseas tenants.
### Internal vs marketplace apps
An internal app's token only reaches its own tenant. Products listed on the Feishu app directory that serve many enterprises must use marketplace apps with app_access_token plus per-tenant authorization — a different model altogether. Confirm the app type at the start of the project; switching midway means reworking the entire auth layer.