KeyKeeperLark (Global)
How an agent gets a Lark (Global) key through KeyKeeper, what to choose on open.larksuite.com, and how KeyKeeper verifies it.
| Template id | lark (also larksuite) |
|---|---|
| Field | lark-app-secret → LARK_APP_SECRET · secret |
| Also | lark-app-id → LARK_APP_ID · plain, confirmed by you |
| Key looks like | whether it can be viewed again is unconfirmed |
| Created at | open.larksuite.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show lark
keykeeper save --provider lark --from-clipboard --create --purpose "what this task does"
keykeeper run -c lark -- <your command>--provider lark fills in the credential id and the fields. The environment
variables are the ones Feishu / Lark's own tools read, so nothing has to be mapped.
What only you can do
Sign in to Lark Open Platform
Create/select a custom app
Add only required permissions and data scopes
Publish/install it in the intended tenant
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Use the global Lark console, LARK environment names and the open.larksuite.com API base. Feishu China credentials/endpoints are separate.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Lark (Global) key (whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: Lark (Global) offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
Public docs do not promise one universal App Secret expiration policy; reset it explicitly when rotating. Rotate or revoke at open.larksuite.com.