agency-feishu-integration-developer

Create an app on the Feishu Open Platform, then use the official oapi-sdk-nodejs client to call im.message.create with msg_type set to interactive and your card JSON. Validate the card in Feishu's Card Builder tool before sending to avoid rendering failures.

tenant_access_token acts on behalf of the app for organization-level APIs, while user_access_token acts on behalf of a specific user and is obtained via the OAuth authorization code flow. Endpoints operating on a user's personal data, like their approval instances, require a user token.

Verify each event using the verification token or decrypt it with the Encrypt Key, and use the SDK's EventDispatcher to handle this automatically. Return HTTP 200 quickly and process events asynchronously and idempotently, since Feishu retries delivery and may send duplicates.

Feishu enforces rate limits that return HTTP 429 when exceeded. Implement retry logic with backoff, cache tokens instead of re-fetching per request, and add delays such as 200ms between Bitable batch writes of up to 500 records.

No, the app_secret must never appear in frontend code. Proxy all Feishu API calls through your own backend, authenticate the user first, then make the API call on their behalf using server-side credentials.