chenhg5/cc-connect · error

wecom: get access_token: %w

Error message

wecom: get access_token: %w

What it means

Before replying, Reply() must obtain a WeCom access_token via getAccessToken() (which exchanges corp_id/corp_secret with the WeCom API and caches it). If that call fails — network error, invalid credentials, WeCom error response — the failure is logged and returned wrapped as "wecom: get access_token: %w".

Source

Thrown at platform/wecom/wecom.go:464

			"msg_type", msg.MsgType,
			"msg_id", msg.MsgId,
			"from_user", msg.FromUserName)
	}
}

func (p *Platform) Reply(ctx context.Context, rctx any, content string) error {
	rc, ok := rctx.(replyContext)
	if !ok {
		return fmt.Errorf("wecom: invalid reply context type %T", rctx)
	}
	if content == "" {
		return nil
	}

	accessToken, err := p.getAccessToken()
	if err != nil {
		slog.Error("wecom: get access_token failed", "error", err)
		return fmt.Errorf("wecom: get access_token: %w", err)
	}

	if !p.enableMarkdown {
		content = core.StripMarkdown(content)
	}

	chunks := splitByBytes(content, 2000)
	for i, chunk := range chunks {
		var sendErr error
		if p.enableMarkdown {
			sendErr = p.sendMarkdown(accessToken, rc.userID, chunk)
		} else {
			sendErr = p.sendText(accessToken, rc.userID, chunk)
		}
		if sendErr != nil {
			slog.Error("wecom: send failed", "user", rc.userID, "chunk", i, "error", sendErr)
			return sendErr
		}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Verify corp_secret/corp_id are current (re-copy from WeCom admin console after any rotation)
2. Check the server can reach the API base URL (curl the gettoken endpoint) and that the app's IP allowlist includes your egress IP
3. Inspect the wrapped cause (%w) in the error/log line to see whether it is a network error or a WeCom errcode
4. If behind a proxy, confirm the proxy option is correct and the proxy allows the API host
5. Retry after fixing credentials; access_token failures are often transient on network blips

Example fix

// before
"corp_secret": "old-rotated-secret" // 40001 invalid credential
// after
"corp_secret": "newSecretFromWeComAdminConsole"

if err := p.Reply(ctx, rctx, msg); err != nil {
	if strings.Contains(err.Error(), "get access_token") {
		// check corp credentials/network, maybe backoff and retry
	}
	slog.Warn("reply failed", "err", err)
}

When it happens

Trigger: getAccessToken returning an error during Reply: unreachable/blocked qyapi.weixin.qq.com, wrong corp_id or corp_secret, expired or revoked secret, WeCom returning errcode != 0 (e.g. 40013 invalid corpid, 40001 invalid credential), or the outbound HTTP request timing out through a broken proxy.

Common situations: Corp secret rotated in the admin console but not in config; server without outbound internet access or a misconfigured proxy; IP not in the WeCom app's trusted IP allowlist; firewall blocking egress to the API domain.

Related errors

• dingtalk: get access token for emotion: %w
• dingtalk: get access token: %w
• wecom: send image: %w
• wecom-ws: ack timeout
• remote returned non-zero code

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/c7f12cf8669ac7b6. Report an issue: GitHub.