How to Find WeChat AppID and AppSecret

Many people do not get stuck on the API itself. They get stuck before that:

• they log in to the WeChat developer platform and cannot find the Official Account entry
• they enter the account area and still cannot find the AppID or AppSecret page
• they see interface settings, but do not know where the developer key or API IP whitelist belongs

This guide only solves one problem:

how to find the Official Account AppID and AppSecret in the current WeChat backend.

If you want to connect:

• access_token
• the draft API
• the media API
• an automated publishing flow

you need this step first.

Start from the WeChat developer platform

The current recommended entry is:

• WeChat Developer Platform

Based on the current platform flow, the path is:

1. open the WeChat developer platform
2. click 登录 in the top-right corner
3. after login, open 我的业务与服务
4. choose 公众号
5. enter the Official Account area and find the interface-management or developer-config page
6. check the AppID, AppSecret, developer key settings, and API IP whitelist

If you still use the legacy Official Account backend, that path is included below as well.

Why people miss the path

The main reason is that the backend path is in transition.

From the current backend notice shown in the interface-management area:

• 设置与开发 - 开发接口管理 is being migrated to the WeChat developer platform starting on December 1, 2025

That is why many older tutorials still say:

• log in to the Official Account backend
• open 设置与开发
• open 开发接口管理

But the current backend already pushes people toward the developer platform.

The simpler rule now is:

• use the WeChat developer platform as the primary path
• treat the old backend as a fallback path

Current path: find the Official Account inside the developer platform

If you are starting from scratch, use this order.

Step 1: open the developer platform and log in

Go here:

• WeChat Developer Platform

Click 登录 in the top-right corner.

After login, do not start hunting for the AppID immediately. Start from the business selector.

Step 2: open 我的业务与服务

After login, the top navigation should include:

• 我的业务与服务

Open it and choose the correct business type.

What you want here is:

• 公众号

Do not stop at the platform home page. You need to enter the Official Account business area first.

Step 3: open interface management or developer settings

Inside the Official Account area, continue looking for entries such as:

• 接口管理
• developer settings
• developer key settings
• API IP whitelist

These pages are where you typically find:

• AppID
• AppSecret
• developer key settings
• API IP whitelist

Legacy path: the old Official Account backend

Some teams still enter from the legacy Official Account backend first. The old path usually looks like this:

1. log in to the Official Account backend
2. find 设置与开发 in the left sidebar
3. open 开发接口管理

Legacy backend entry:

• Official Account backend

If this page shows a migration notice, do not spend time fighting the old path. Move to the developer platform and continue there.

Where to find the AppID

Once you are on the interface-management or developer-config page, check the AppID first.

The AppID is usually displayed directly and acts as the account identifier for API access.

The simplest way to think about it is:

• AppID is the account identifier
• AppSecret is the paired secret

If you are preparing a server config, copy the AppID first.

Where to find the AppSecret

On the same page, you should also find the developer key or secret-related area that contains the AppSecret.

There are two practical things to keep in mind.

1. It may not always be shown as a long-term plain value

Some backends emphasize reset or regeneration instead of permanently showing the previous secret in full.

So if you do not see a full old value sitting there forever, that does not necessarily mean you are on the wrong page.

A safer rule is:

• follow the current page behavior
• if the value is visible, copy and store it immediately
• if the page only offers reset, reset it and store the new value immediately

2. The AppSecret belongs on the server side only

Do not put it into:

• frontend code
• browser requests
• mini-program client code
• public repositories

It belongs in your server-side environment variables.

Do not skip the developer key and API IP whitelist

Many people copy the AppID and AppSecret, then wonder why the API still fails. The missing piece is often on the same page.

You should also check:

Developer key settings

If the page asks you to set, reset, or update the developer secret, do it according to the current backend requirement.

API IP whitelist

If your server is calling WeChat APIs directly, you usually also need:

• API IP whitelist

This should contain your server egress IP, not your laptop IP and not your end users' IP addresses.

A common situation looks like this:

• the code is fine
• AppID and AppSecret are filled in
• but the server call is still blocked

That is when you should return to the whitelist and confirm the IP is correct.

The safest order to follow

If your goal is simply to get the WeChat API connected, use this order:

1. log in to the WeChat developer platform
2. open 我的业务与服务
3. choose 公众号
4. open interface management or developer config
5. copy the AppID
6. confirm whether the AppSecret is currently visible or needs reset
7. configure the API IP whitelist
8. store the values in your server environment

That avoids the usual back-and-forth once you start requesting access_token.

What to do if the AppSecret is exposed

Do not delay this.

If you suspect the secret has appeared in:

• a screenshot
• a commit history
• a public repository
• a third-party collaboration tool

do not keep using the old value.

A safer response is:

1. go back to the developer-config page immediately
2. use the platform's current recovery action
3. reset the secret first
4. if the backend offers a freeze option, freeze it while you investigate
5. update the new value in your server environment
6. check whether any old service is still using the old secret

The rule is simple: if you suspect exposure, rotate it.

Two common mistakes

1. Looking for AppID and AppSecret in the API docs

The docs explain how to call the API. They do not contain your account's actual credentials.

Those values only exist inside the logged-in business backend.

2. Assuming the old Official Account backend is the only path

That is no longer reliable.

Because the interface-management path is being migrated, the developer platform is now the path to remember:

• WeChat Developer Platform

Short version

If you only want the shortest path, do this:

1. open WeChat Developer Platform
2. click 登录
3. open 我的业务与服务
4. choose 公众号
5. enter interface management or developer config
6. copy the AppID
7. view or reset the AppSecret
8. configure the API IP whitelist

If you are connecting WeChat APIs next, continue with:

• What Is the WeChat Draft API?
• How to Connect the WeChat draft_add API
• WeChat add_material API Notes