1. Users can only log in to mobile apps via Weixin using the native login method and need to install the Weixin app.

2. For Android apps, it is recommended to always display the Weixin Login button. When the Weixin app is not installed on the user's mobile phone, guide the user through downloading and installing the Weixin app.

3. For iOS apps, considering the related regulations stipulated in the App Store Review Guidelines, it is recommended that when accessing Weixin Login, developers check whether the Weixin app has been installed (using the isWXAppInstalled function in the SDK). For users who do not install the Weixin app, the Weixin Login button is hidden and only other login methods (e.g. mobile number registration and login and guest login) are provided.

1. When a third-party app initiates a Weixin login authorization request, after a Weixin user grants authorization to the third-party app, Weixin will launch the app or redirect to the third-party website and carry the authorized temporary ticket code parameter.

2.  Add AppID, AppSecret, and other information via code, and exchange for access_token using the relevant API.

3. Use access_token to call the API to obtain the user's basic data and resources or help the user perform a basic operation.

-(void)sendAuthRequest
{
	// Build a SendAuthReq structure
	SendAuthReq* req =[[[SendAuthReq alloc]init]autorelease];
	req.scope = @"snsapi_userinfo";
	req.state = @"123";
	// The third party sends a SendAuthReq message structure to the Weixin platform.
	[WXApi sendReq:req];
}

{
	// Send oauth request
	Final SendAuth.Req req = new SendAuth.Req();
	req.scope = "snsapi_userinfo";
	req.state = "wechat_sdk_demo_test";
	api.sendReq(req);
}

appid: wxd477edab60670232
scope: snsapi_userinfo
state: wechat_sdk_demo

https://api.weixin.qq.com/sns/oauth2/access_token?appid=APPID&secret=SECRET&code=CODE&grant_type=authorization_code

{ 
"access_token":"ACCESS_TOKEN", 
"expires_in":7200, 
"refresh_token":"REFRESH_TOKEN",
"openid":"OPENID", 
"scope":"SCOPE",
"unionid":"o6_bmasdasdsad6_2sgVt7hMZOPfL"
}

{"errcode":40029,"errmsg":"invalid code"}

1. If access_token has expired, performing refresh_token will give you a new access_token with a new expiration time.
2. If access_token has not expired, performing refresh_token will not change access_token, but will extend the validity period. This is like renewing access_token.

https://api.weixin.qq.com/sns/oauth2/refresh_token?appid=APPID&grant_type=refresh_token&refresh_token=REFRESH_TOKEN

{
"access_token":"ACCESS_TOKEN",
"expires_in":7200,
"refresh_token":"REFRESH_TOKEN",
"openid":"OPENID",
"scope":"SCOPE"
}

{"errcode":40030,"errmsg":"invalid refresh_token"}

1. Appsecret  is the key used to access the app. If it is leaked, it may lead to the disclosure of app data and app user data, and other high-risk consequences. If stored on clients, it is at risk of theft (i.e., by decompilation).
2. access_token  is the credential (equivalent to the user login status) by which users authorize third-party apps to initiate API calls. If stored on clients, it can be stolen and used to leak user data or maliciously make calls to Weixin APIs.
3. refresh_token  is a credential by which users authorize third-party apps. It has a longer validity period than the access_token and can only be obtained by refreshing access_token. If leaked, it entails the same risks as access_token .

```





**It is recommended that Appsecret and user data (e.g. access_token) be stored in the app cloud server and that the cloud server forward the API call request.**





**Step 3: Use access_token to call the API**


After obtaining access_token, you can call the API provided the following:


1. The access_token is valid and does not expire.
2. The Weixin user has authorized the corresponding API scope to a thirty-party app account.


The APIs that can be called for different scopes are shown below:



| Authorization Scope | API | API Description |
| --- | --- | --- |
| snsapi_base | /sns/oauth2/access_token | Gets obtain access_token, refresh_token, and authorized scope via code |
| /sns/oauth2/refresh_token | Refreshes or renews access_token |
| /sns/auth | Checks the validity of access_token |
| snsapi_userinfo | /sns/userinfo | Gets the user's personal information |



snsapi_base is a basic API. If the app has permissions in other scopes, it has the snsapi_base permission by default. With snsapi_base, mobile webpages can directly redirect to third-party webpages with temporary authorization ticket (code), without having to request users to authorize on the authorization page. However, this may limit the user authorized scope to only snsapi_base, resulting in failure to get data and basic features that require user authorization.



For the API call method, refer to the [Guide for API Call of Weixin Authorization Relation](/doc/oplatform/Mobile_App/WeChat_Login/Authorized_API_call_UnionID.html).


**FAQs**

**1. What is a temporary code for authorization?**


A: The temporary code for authorization is used to get access_token by third parties. The code is only valid for 10 minutes and one code can only be used to retrieve one access_token at a time, which ensures the security of Weixin authorization login. Third parties can use the https and state parameters to further enhance the security of their own authorization login process.





**2. What is authorization scope?**


A: The authorization scope represents the range of API permissions that the user grants to the third party. The third-party app must apply to the Weixin Open Platform for permissions included in the relevant scope. Then, it can have the user grant authorization as described in the usage documentation. After the user grants authorization and the app obtains the relevant access_token, it can call the APIs in the scope.


**3. Is a fee charged for Mobile App Login via Weixin on the Open Platform?**


A: "Weixin Login" allows the huge user value of Weixin to be shared with third-party websites, while also providing more convenient services and better contents for Weixin users, thus achieving a 'win-win' for both users and third-parties. Currently, no fee is charged.