Third-party App Login (LoginByAppSecret)

## Overview LoginByAppSecret is the recommended authentication entry point of the Kingdee K3 Cloud WebAPI for third-party integrations. Instead of sending a plaintext password (ValidateUser), the caller authenticates with an AppID/AppSecret pair that is created in the Kingdee console under Open Service Cloud > OpenAPI > Third-party Applications, together with a proxy user whose permissions scope all subsequent API calls. ### How it works 1. Create a third-party application in K3 Cloud and note its AppID and AppSecret. Bind a proxy user to the application. 2. POST a JSON body containing acctID (the data-center/account-set id), username, appid, appsecret and lcid (2052 for Chinese) to this endpoint. 3. A LoginResultType of 1 indicates success. The response sets session cookies that must be replayed on every business API call such as ExecuteBillQuery; calls without the session cookie are rejected. 4. Sessions expire. A production integration should detect session-expired failures, re-login automatically, and serialize concurrent logins to avoid being throttled. ### Notes - All K3 Cloud WebAPI URLs end with .common.kdsvc and require Content-Type: application/json. - acctID is the account-set code, not the company name; find it in the login URL or the data-center manager. - For on-premise deployments, terminate TLS properly and configure the private base URL in the iPaaS connector.