## Overview
Every WeCom (WeChat Work) server API authenticates with an access_token: an internal app exchanges corpid plus its corpsecret at this endpoint. The token is valid for 7200 seconds and reusable until expiry. corpsecret is shown under Apps > Self-built in the admin console; contact APIs require the separate secret of the Contact Sync assistant.
### Steps
1. Create a self-built app and note its AgentId and Secret; the corpid sits at the bottom of the My Company page.
2. Configure the app's trusted IPs — WeCom enforces this and rejects other egress IPs with error 60020.
3. Fetch and cache the token, refreshing ahead of expiry; different secrets (app secret vs contact secret) issue different tokens and must be cached separately.
4. Business calls append access_token to the URL query.
### Response
Success: {"errcode":0,"errmsg":"ok","access_token":"xxxx","expires_in":7200}. Non-zero errcodes map to the global error-code reference.
### Production advice
The Qeasy connector keeps a per-corpid+secret singleton token cache with concurrency control, so multiple apps/secrets never thrash each other's cached token.
### Managing multiple secrets
An enterprise typically holds at least an app secret and a contact-sync secret, sometimes an external-contact secret too. Tokens issued from different secrets are not interchangeable — key the cache by corpid plus secret purpose. Cross-use surfaces as error 40014 and is easily misdiagnosed as an expired token, burning hours in troubleshooting.