App authorizations

App authorizations lets enterprise services call QwenWork management APIs. An application's API Key identifies the caller, while its permission configuration determines accessible APIs. Creating a key does not grant all permissions.

​

Create an enterprise application

1. Open Open & Integration → Open Platform → App authorizations and click Create app.
2. Enter a name and purpose, such as “HR directory integration”, select API permissions, and create it. A key named Default is generated. Its full value is shown only once; save it before closing the dialog.
3. Open the application's name or view action and check basic information.

Admin console: maintain applications and their enabled states.

​

Configure API permissions

1. Open the application's permission configuration and edit it.
2. Select the required scope and check read and write permissions individually.
3. Save, reopen, and verify the actual granted set.
4. Give the developer the required API and permission names and check request requirements in Developer docs.

​

Create and use an API Key

1. Open application credentials and create an API Key.
2. Enter the key name, expiry, and other requested fields, then confirm.
3. The full key is shown once. Immediately store it in the enterprise's secret-management system. The list mask cannot recover it.
4. Inject it into the calling service and follow the API documentation using Authorization: Bearer <API_KEY>.
5. Confirm the application is enabled and call an authorized read-only API. Check its response.

​

Rotate, disable, or delete

For rotation, create a new key, update the service, verify a successful call, then disable the old key. If a leak is suspected, promptly disable the affected key and inspect recent usage and call logs. Disable the application to pause the integration. Before deletion, disable it and confirm callers have stopped using it; deletion is unavailable while enabled. Disabling an application or key interrupts dependent services.

​

Handle calling errors

• 401: Check the key, request header, and application state.
• 403: Check API permissions and target data scope.

Follow the API's documented error response for further handling. Identify the missing permission rather than granting all permissions. Return to: Open Platform overview