Connect a chatbot to a WeChat Official Account so people can ask it questions inside WeChat. Pro plan only.
Two hard requirements sit outside the software:
1. It must be a verified Service Account (认证服务号). WeChat has several account types and only a Service Account can use the customer-service messaging API this depends on. On a Subscription Account, connecting will succeed and every reply will fail with error 48001. Aimy translates that code into plain words, but it cannot work around it.
2. Registering one generally requires a Chinese business entity — a business licence and paid annual verification. An overseas Official Account exists but is more limited.
Aimy itself does not need a Chinese entity: credentials are per-customer, like every other channel here. But somebody has to own a qualifying account, and if you do not have access to one, this channel cannot be tested end to end. Connecting and sandbox-testing the signature path is still possible — see the last section.
1. AppID and AppSecret. In the WeChat console: Settings & Development → Basic Configuration (设置与开发 → 基本配置). The AppID is shown; the AppSecret must be generated, and is displayed once.
2. Choose a Token. On the same page, under Server Configuration (服务器配置), you invent this value yourself — any string. You will type the same value into both WeChat and Aimy. It is what signs incoming callbacks.
3. EncodingAESKey — only if using safe mode. Generate it on the same page. It is exactly 43 characters. Leave it out entirely if the account is in plaintext mode.
4. This step is easy to miss and breaks everything silently. WeChat requires the calling server's IP to be on an allow-list before it will issue an access token. In Basic Configuration, find the IP whitelist (IP白名单) and add this server's public IP.
Without it, connecting fails with "This server's IP is not on the account's IP allow-list".
5. Open the integration. Integrations → the WeChat card → pick your chatbot from the tabs.
6. Fill in the fields — AppID, AppSecret, Token, and EncodingAESKey if you are using safe mode — then click Connect.
Verify: Aimy fetches an access token from WeChat to prove the AppID and AppSecret are a real pair. If that works, the credentials and the IP allow-list are both correct.
7. Copy the Server URL from the box that appears.
8. Paste it into WeChat. In Basic Configuration → Server Configuration, set:
9. Click Submit. WeChat immediately calls the URL with a verification challenge and only saves if the response is exactly right.
Verify: if it saves, your signature check is provably working. If it fails, the Token does not match between the two sides — that is nearly always the cause.
10. Enable the server configuration. Saving is not the same as switching it on. Make sure the configuration shows as enabled (启用).
11. Follow the account in the WeChat app — scan the account's QR code from the console.
12. Send a real question your documents can answer.
Verify: the answer should arrive within a few seconds. Then check Chat History, and the usage breakdown should show activity under WeChat.
WeChat gives a callback about five seconds before it retries, and our answers take longer — so Aimy acknowledges immediately with success and a background worker pushes the answer afterwards through the customer-service API.
In safe mode the message body is AES-256 encrypted, and the decrypted payload carries the AppID, which Aimy checks — that is what stops a correctly encrypted message from a different account being accepted.
Answers are split on bytes, not characters, because WeChat caps a message at 2,048 bytes and Chinese takes three bytes per character. A character-based limit would be wrong by a factor of three on exactly the audience this channel serves.
WeChat only permits a reply within 48 hours of that user's last message. Fine for question-and-answer. It does mean a live agent picking up a handoff more than two days later will fail — Aimy reports that plainly rather than dropping the message silently.
You can still exercise most of the path. WeChat's sandbox / test account (测试号) gives an AppID, AppSecret and Token without any business verification, and supports the same callback and customer-service APIs. That is enough to verify signature checking, the URL handshake, message parsing and the reply path.
What it will not prove is behaviour on a real verified account under real quota. Treat a sandbox pass as "the code works" and leave WeChat marked Coming soon until a customer with a real account confirms it.