Skip to main content

WeChat Login

WeChat Login allows users to sign in to an application using their existing WeChat identity. It is commonly used for China-facing apps, websites, customer portals, and services where users are likely to already have WeChat accounts.

This page explains what WeChat Login does, where it fits, what it does not provide by itself, and what clients should consider before deciding whether to use it.

For detailed platform-specific implementation steps, clients and developers should refer to the official WeChat documentation linked at the end of this page.

What WeChat Login is​

WeChat Login is an authentication method.

It allows an application to confirm that a user has authorized login through WeChat and to receive WeChat user identifiers that can be linked to the application's own user account system.

In simple terms, WeChat Login helps answer this question:

Which WeChat user is trying to log in?

After that, the application still needs to decide what that user is allowed to do.

For example, if a customer portal uses WeChat Login, WeChat can help identify the user. The portal still needs its own backend logic to decide whether that user is an approved customer, which company or account they belong to, and which files or features they can access.

Where WeChat Login fits​

WeChat Login can be used as part of a broader identity and access management system.

It can be used for:

  • User authentication
  • Social login
  • Account binding
  • China-localized login experiences
  • Reducing the need for users to remember another password
  • Linking a WeChat identity to an existing application account

However, WeChat Login does not provide the full application-side identity and access management layer by itself.

If your application requires any of the following, they must be handled separately by your backend, admin system, or identity management system:

  • Customer verification
  • User approval workflows
  • User-to-customer or user-to-organization mapping
  • Roles and permissions
  • File or resource access control
  • User suspension and revocation
  • Admin user management
  • Audit logs
  • Backup login or account recovery
  • Enterprise SSO, MFA policies, or organization-level identity governance

In these cases, WeChat Login can still be used, but it should be treated as one authentication method connected to your own user management and authorization system.

When WeChat Login is a good fit​

For China-facing applications, WeChat Login is often considered because many users already have WeChat accounts and are familiar with WeChat-based authorization flows.

WeChat Login may be a good fit when:

  • Most target users are expected to have WeChat accounts.
  • You want to provide a familiar China-local login method.
  • You want to reduce friction compared with password-based login.
  • You want users to bind a WeChat identity to an existing application account.
  • You have, or plan to build, a backend system that manages users, sessions, permissions, and access control.
  • You want WeChat identity to be one part of a broader authentication or account-binding flow.

What WeChat Login should be paired with​

WeChat Login can be used in applications that require customer identity management, roles, permissions, approval workflows, or enterprise access control. However, WeChat Login should not be expected to provide those functions by itself.

In those cases, WeChat Login should be paired with the application's own backend, admin system, or identity management layer.

For example:

  • If users need to be approved before accessing the service, the approval workflow should be handled by the application.
  • If users belong to specific customers, companies, or organizations, that mapping should be handled by the application.
  • If users have different roles or permissions, those rules should be handled by the application.
  • If users need access to specific files, records, or services, access control should be handled by the application.
  • If users need to be suspended, revoked, or removed, that should be handled by the application.
  • If the system needs audit logs, download logs, or compliance records, those should be handled by the application.
  • If users may not have WeChat accounts, the application should provide another login or recovery method.
  • If the system needs enterprise SSO, MFA policies, or organization-level identity governance, WeChat Login should be integrated as one authentication method within that broader identity architecture.

The key question is not whether WeChat Login can be used in these systems. It can. The key question is whether the required user management, authorization, and governance features will be handled somewhere else in the architecture.

Common WeChat Login scenarios​

The correct WeChat Login setup depends on where users access your service.

Native Android and iOS app login​

This applies when users log in from a native mobile app.

Typical use case:

A user opens an Android or iOS app, taps "Log in with WeChat," authorizes through the WeChat app, and returns to the mobile app.

This normally requires a WeChat Open Platform Mobile Application setup.

For Android, the setup usually involves the app package name and app signature.

For iOS, the setup usually involves the Bundle ID and Universal Links.

This is the correct option when the login flow happens inside a native Android or iOS app.

Website QR-code login​

This applies when users log in from a browser, especially from a desktop browser.

Typical use case:

A user opens a website or customer portal, clicks "Log in with WeChat," scans a QR code with WeChat, authorizes login, and is redirected back to the website.

This normally requires a WeChat Open Platform Website Application setup.

This is the correct option for browser-based portals or websites.

Official Account webpage authorization​

This applies when users access a webpage from inside WeChat, usually through a WeChat Official Account menu, article, or message.

Typical use case:

A user opens a link inside WeChat and the webpage identifies the user through the associated Official Account authorization flow.

This is useful when the user journey starts inside WeChat.

Mini Program login​

This applies when users access the service through a WeChat Mini Program.

Typical use case:

A user opens a Mini Program and logs in through the Mini Program's WeChat login flow.

This requires a WeChat Mini Program setup and is separate from native mobile app login or website login.

How WeChat Login works at a high level​

Although the details vary depending on the scenario, the general flow is similar:

User starts WeChat Login
  |
  v
User authorizes through WeChat
  |
  v
Application receives a temporary authorization code
  |
  v
Application backend exchanges the code with WeChat
  |
  v
WeChat returns user identifiers
  |
  v
Application backend links the WeChat identity to a local user
  |
  v
Application issues its own session or token

The important point is that the application backend remains responsible for the application's own user session, permissions, and access control.

The WeChat access token should not be treated as the application's own session token.

Key identity concepts​

openid​

openid is a WeChat user identifier within a specific WeChat application context.

The same person may have different openid values across different WeChat channels, such as:

  • Native mobile app
  • Website application
  • Official Account
  • Mini Program

Because of this, openid should normally be stored together with the WeChat application or channel it belongs to.

unionid​

unionid can identify the same WeChat user across multiple WeChat applications under the same WeChat Open Platform account, when available.

This can be useful when the same service uses multiple WeChat channels, such as a mobile app, website, Official Account, or Mini Program.

However, unionid may not always be available. The application should be designed to handle cases where only openid is available.

Local application user​

The application should still maintain its own internal user account.

The local application user is what should be used for:

  • Customer records
  • Permissions
  • Organization or company mapping
  • File access
  • Order history
  • Audit logs
  • User suspension or revocation

WeChat identifiers should be linked to this local user account, not replace it entirely.

Backend requirements​

A backend is normally required for a secure WeChat Login implementation.

At a high level, the backend is responsible for:

  • Receiving the temporary authorization code
  • Exchanging the code with WeChat
  • Receiving the WeChat user identifiers
  • Finding or creating the local application user
  • Binding the WeChat identity to the local user
  • Applying customer verification and permission rules
  • Issuing the application's own session or token

The WeChat AppSecret should only be stored on the backend. It should not be included in mobile app code, frontend JavaScript, Mini Program frontend code, or public repositories.

Client-side work required​

The work required from the client depends on the login scenario.

For native Android and iOS app login, the client or app developer may need to provide:

  • Android package name
  • Android app signature
  • iOS Bundle ID
  • iOS Universal Link
  • App Store or Android app store links, if available
  • App icon and screenshots
  • App ownership or authorization information
  • Access to update the Android and iOS apps
  • A backend endpoint or backend team to support the login integration

For website QR-code login, the client may need to provide:

  • Website domain
  • Login callback URL
  • Website name and description
  • Website logo and screenshots
  • Backend support for the login callback
  • Website ownership or authorization information

For Official Account or Mini Program login, the client may need to provide:

  • Official Account or Mini Program ownership information
  • Relevant AppID or account access
  • Domain and authorization settings
  • Backend support for the login flow

For iOS mobile app login, Universal Links are usually required.

A Universal Link is an HTTPS URL associated with the iOS app. It allows iOS to return the user from WeChat back into the correct app after authorization.

Setting up Universal Links usually requires coordination between:

  • The app owner
  • The iOS developer
  • The team that controls the relevant domain
  • The WeChat Open Platform administrator

The client should expect to provide or configure:

  • A domain controlled by the app owner
  • HTTPS support
  • Apple Team ID
  • iOS Bundle ID
  • Associated Domains configuration in the iOS app
  • The required Apple association file on the domain

The exact implementation should follow Apple and WeChat's official documentation.

Ownership and account management​

The WeChat Open Platform application, Official Account, or Mini Program should normally be owned by the same legal entity that owns the app, website, or customer relationship.

Using a third party's WeChat account can create issues such as:

  • Incorrect branding on the authorization screen
  • Long-term dependency on the third party
  • Migration complexity
  • Unclear control over AppID and AppSecret
  • Unclear responsibility for security and data protection
  • Potential issues during client offboarding

If AppInChina helps create or manage the WeChat setup on behalf of a client, the responsibility model should be agreed in advance.

At minimum, the following should be clarified:

  • Who owns the WeChat Open Platform account
  • Who owns the AppID and AppSecret
  • Who manages callback domains or Universal Links
  • Who stores the AppSecret
  • Who maintains the backend integration
  • Who handles user support and access issues
  • What happens if the client wants to migrate away later

Questions to confirm before choosing WeChat Login​

Before deciding whether WeChat Login is the right fit, the following questions should be confirmed:

  1. Where will users access the service?

    • Android app
    • iOS app
    • Desktop browser
    • Mobile browser
    • Page opened inside WeChat
    • WeChat Mini Program

  2. Is WeChat Login expected to be the only login method, or one of several login methods?

  3. Should any WeChat user be able to create an account, or should users be pre-approved?

  4. Does the application need customer accounts, organizations, companies, or roles?

  5. What should happen after the user is authenticated?

  6. What resources or features should the user be able to access?

  7. Who can approve, revoke, or manage users?

  8. Is a backup login or account recovery method required?

  9. Does the application need to support users who do not have WeChat accounts?

  10. Does the application need to link the same user across mobile app, website, Official Account, or Mini Program?

  11. Who will own and manage the WeChat Open Platform, Official Account, or Mini Program setup?

What AppInChina can help with​

Depending on the project scope, AppInChina can help clients understand:

  • Which WeChat Login scenario is most appropriate
  • What WeChat account or application setup is required
  • What information is needed from the client
  • What work is required from the client's mobile, web, or backend teams
  • How WeChat Login fits into the broader China launch or localization plan
  • What risks or limitations should be considered before implementation

Implementation details, SDK integration steps, and API-specific behavior should be confirmed against the official WeChat documentation.

Official documentation​

The following official WeChat documentation should be reviewed depending on the integration type.

Mobile app login​

Website login​

Official Account webpage authorization​

Mini Program login​

Summary​

WeChat Login is a useful authentication method for China-facing applications, especially when users are expected to already have WeChat accounts.

It can be used as part of a broader identity and access management system, but it should not be treated as the full identity and access management system by itself.

The application still needs its own backend, user database, account mapping, permissions, revocation logic, session management, and audit logging.

The correct WeChat Login setup depends on where users access the service:

  • Native Android or iOS app: Mobile Application WeChat Login
  • Browser-based portal or website: Website QR-code login
  • Page opened inside WeChat: Official Account webpage authorization
  • WeChat Mini Program: Mini Program login

Before implementation, clients should confirm the access channel, ownership model, backend requirements, user management requirements, and whether WeChat Login is expected to be the only login method or one part of a broader authentication system.