OpenAB WeCom Bundle

One-click OpenAB deployment for WeCom (企业微信) — bot agent + callback gateway bundled together. Fill in the 5 WeCom credentials and paste the callback URL into WeCom admin once.

WeCom ──POST──▶ ┌──────────────────┐ ◀──WebSocket── ┌────────────┐
                │  openab-gateway  │                │   openab   │
                │  (wecom only)    │                │  (Kiro CLI) │
                └──────────────────┘                └────────────┘
                   public HTTPS                       internal only

Limitation: WeCom self-built app callbacks only deliver direct messages to the bot. Group chat is not supported via this channel (it requires the WeCom appchat / WS bot API, which is not yet wired into the gateway). DMs work fine.

What's deployed

Service	Purpose	Public
openab	OAB agent running Kiro CLI	No
openab-gateway	WeCom callback → WebSocket bridge	Yes (auto HTTPS)

No PVC sharing, no manual config.toml edits. The agent's config.toml is generated on first boot with the gateway URL pre-wired to ws://openab-gateway:8080/ws and platform = "wecom".

Setup order matters

Unlike Telegram (auto-register) or LINE (paste URL anytime), WeCom verifies the callback URL when you click Save in WeCom admin — so the gateway must be running with the matching Token + EncodingAESKey before you save in WeCom.

Recommended order: prepare the values in WeCom (without saving) → deploy bundle with those values → save in WeCom.

Setup

1. Create a Self-Built App in WeCom

Requires a WeCom (企业微信) enterprise account with admin access.

1. Go to WeCom Admin Console → 应用管理 → 自建 → 创建应用 → fill in name / icon / visible scope.
2. On the new app's detail page, copy:
   • AgentId → paste into WeCom Agent ID
   • Secret → click "查看", verify via WeCom mobile app → copy → paste into WeCom Secret
3. Click 我的企业 (top nav) → 企业信息 → copy 企业ID → paste into WeCom Corp ID.

2. Prepare Token + EncodingAESKey (don't save yet)

On the app detail page → 接收消息 → 设置API接收:

1. Token → click "随机获取" (random) or set your own → paste into WeCom Callback Token.
2. EncodingAESKey → click "随机获取" (random) → paste into WeCom EncodingAESKey.
3. URL field stays blank for now — you'll fill it in step 5.
4. Do NOT click Save — WeCom would try to verify the URL immediately and fail.

3. (Optional) Get a Kiro API Key

If you have a paid Kiro subscription, go to kiro.dev → Settings → API Keys → create a key and paste it into KIRO_API_KEY. Free tier users skip this and authenticate post-deploy in step 6.

4. Deploy

Click deploy with the 5 WeCom values filled in. A public HTTPS domain is auto-assigned to the gateway service.

5. Fill the Callback URL in WeCom & Save

1. Open the openab-gateway service page in Zeabur Dashboard → look at the auto-assigned domain.
2. The full callback URL is: https://<YOUR_GATEWAY_DOMAIN>/webhook/wecom
3. Back in WeCom admin → 接收消息 → 设置API接收 → URL → paste the URL.
4. Click 保存 — WeCom hits the gateway with a verification GET; if your Token + EncodingAESKey match the env vars, the save succeeds. If verification fails, double-check both values in both places.

The openab-gateway service Instructions section shows the exact callback URL pre-filled.

6. Authenticate Kiro via Device Flow (free tier only)

Skip if you set KIRO_API_KEY in step 3.

After the openab service is running, open its terminal in Zeabur Dashboard and run:

runuser -u agent -- kiro-cli login --use-device-flow

Follow the URL and code to authorize in your browser.

7. Test

In WeCom, open the bot (under your app's visible scope) and send a DM. The gateway decrypts the callback, forwards to OAB, and OAB replies back through the gateway → WeCom message API.

Remember: only DMs trigger the bot. Group chat is not supported.

Customization

• /home/agent/.config/openab/config.toml — OAB config (sessions, reactions, etc.). Created on first boot from a built-in template with the [gateway] block pre-wired. To regenerate, delete and restart.
• Image tags — bot tracks the floating stable channel (ghcr.io/openabdev/openab:stable) and auto-updates with each OpenAB stable release. Gateway is pinned at ghcr.io/openabdev/openab-gateway:0.5.1 (no :stable tag yet). To pin or bump, change the tag in Zeabur Dashboard → Service → Settings. Available tags: OpenAB / Gateway.

Why no automatic callback registration?

WeCom's self-built app callback is configured in the WeCom admin console, not via API. The bundle pre-fills the callback URL in the gateway's Instructions section for easy copy-paste; you only need to paste it once.

Want a different agent backend?

This bundle uses Kiro as the default agent. For Claude / Codex / Cursor / Gemini / OpenCode / Hermes / Grok, deploy the corresponding bot template separately together with the standalone OpenAB Gateway.

Want a different platform?

See OpenAB Telegram Bundle / Feishu Bundle / LINE Bundle or the standalone OpenAB Gateway for Google Chat, MS Teams.

Links

• OpenAB GitHub
• WeCom Setup Guide
• Standalone OpenAB Gateway Template