WeCom Bot + Self-hosted AI Service in 30 Minutes

1. Log in to work.weixin.qq.com (as company admin) → App Management → Self-built → Create App
2. Fill in the app name/icon → open the app details page and record three values:
   • CorpID (My Company → Company Info → bottom of page)
   • AgentId (on the app details page, numeric)
   • Secret (App details → Secret → View; once you leave the page you must reset it to see it again)
3. App details → Trusted IP: add your server's public egress IP (skip this and API calls fail with 60020 — see error 3 below)
4. App details → Receive Messages → API receive settings: fill in a Token (any random string you make up) and EncodingAESKey (click "generate random")
5. The "Receive Messages" page will ask for a callback URL — leave it empty for now, come back after step 3 gives you a public URL via ngrok

WeCom callback verification is one layer deeper than Feishu: the GET request carries msg_signature, and echostr is AES-encrypted — you must decrypt it first, then return it as-is. Copy this code:

import hashlib, base64, struct
from flask import Flask, request, Response
from Crypto.Cipher import AES

app = Flask(__name__)

TOKEN = "your-token"
AES_KEY = "your-encoding-aes-key"  # 43 chars; append "=" in code
CORP_ID = "your-corp-id"

def decrypt_msg(encrypted):
    key = base64.b64decode(AES_KEY + "=")
    cipher = AES.new(key, AES.MODE_CBC, key[:16])
    plain = cipher.decrypt(base64.b64decode(encrypted))
    pad = plain[-1]
    plain = plain[:-pad]                      # strip PKCS7 padding
    plain = plain[16:]                        # strip 16-byte random prefix
    msg_len = struct.unpack("!i", plain[:4])[0]
    return plain[4:4 + msg_len].decode()      # the message body

def verify_signature(signature, timestamp, nonce, echostr):
    s = "".join(sorted([TOKEN, timestamp, nonce, echostr]))
    return hashlib.sha1(s.encode()).hexdigest() == signature

@app.route("/wecom/callback", methods=["GET"])
def verify_url():
    args = request.args
    if verify_signature(args["msg_signature"], args["timestamp"],
                        args["nonce"], args["echostr"]):
        return Response(decrypt_msg(args["echostr"]), mimetype="text/plain")
    return "signature error", 403

@app.route("/wecom/callback", methods=["POST"])
def receive_msg():
    # WeCom POSTs { Encrypt: "..." }; verify signature, then decrypt.
    # The decrypted payload is XML: <MsgType>text</MsgType> + Content + FromUserName...
    # Log it for now; swap in the AI call in step 4.
    return Response("success", mimetype="text/plain")

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8080)

⚠️ Dependencies: pip install flask pycryptodome. WeCom requires the callback to return plain text success (not JSON) — anything else and it keeps retrying delivery.

1. Run: ngrok http 8080 (cloudflared or bore work too)
2. Copy a URL like https://xxxx.ngrok-free.app
3. Back in WeCom "Receive Messages" → enter https://xxxx.ngrok-free.app/wecom/callback → Save
4. WeCom immediately issues a GET verification request — your verify_url() returns the decrypted echostr and the save succeeds

The POST callback payload is XML after decryption — parse it with xml.etree, call your AI, then reply to the employee via the "send app message" API:

import requests, xml.etree.ElementTree as ET

def get_access_token():
    url = "https://qyapi.weixin.qq.com/cgi-bin/gettoken"
    r = requests.get(url, params={"corpid": CORP_ID, "corpsecret": SECRET},
                     timeout=10)
    return r.json()["access_token"]          # valid 2h; cache it

def send_to_user(user_id, content):
    token = get_access_token()
    url = "https://qyapi.weixin.qq.com/cgi-bin/message/send"
    requests.post(url, params={"access_token": token}, json={
        "touser": user_id,                    # UserID, not phone/name
        "msgtype": "text",
        "agentid": AGENT_ID,
        "text": {"content": content}
    }, timeout=10)

# inside receive_msg(), after decrypting xml_str:
root = ET.fromstring(xml_str)
user_id = root.findtext("FromUserName")      # employee UserID
content = root.findtext("Content")           # the employee's text

reply = ask_ai(content)                       # call your self-hosted AI
send_to_user(user_id, reply)

Once it works end to end, add:

• Memory (redis: user_id → conversation history)
• Knowledge-base retrieval (search KB before calling the LLM)
• Skill invocation (handle fixed workflows from templates)

1. App details → Visible Scope: start with one department (e.g. IT) for a pilot
2. Swap the ngrok URL for an Nginx reverse proxy on your server (proxy_pass http://127.0.0.1:8080) or deploy directly
3. My Company → WeChat Plugin — employees can now search for your app inside WeCom
4. Send the app a message → get an AI reply → done