KeyKeeperFeishu 飞书 (中国)
How an agent gets a Feishu 飞书 (中国) key through KeyKeeper, what to choose on open.feishu.cn, and how KeyKeeper verifies it.
| Template id | feishu (also 飞书) |
|---|---|
| Field | feishu-app-secret → FEISHU_APP_SECRET · secret |
| Also | feishu-app-id → FEISHU_APP_ID · plain, confirmed by you |
| Key looks like | whether it can be viewed again is unconfirmed |
| Created at | open.feishu.cn |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show feishu
keykeeper save --provider feishu --from-clipboard --create --purpose "what this task does"
keykeeper run -c feishu -- <your command>--provider feishu fills in the credential id and the fields. The environment
variables are the ones Feishu / Lark's own tools read, so nothing has to be mapped.
What only you can do
Sign in to Feishu Open Platform
Create or select a custom app
Add only required permissions and data scopes
Publish/install the app in the intended tenant
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Use a custom app with only the exact API permissions and smallest data scope needed. Keep App ID as public metadata and App Secret as the only secret field.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Feishu 飞书 (中国) key (whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: Feishu 飞书 (中国) offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
The App Secret remains valid until reset. Rotate or revoke at open.feishu.cn.