WeChat Official Account: Access, Roles & Permissions

Tencent describes two Official Account types: a Subscription Account for publishing and reader communication, and a Service Account for business user management and customer service (Tencent Official Accounts). That product choice matters more than a generic request for a “WeChat business account.” If a media team mainly publishes articles, the Subscription Account is the relevant object. If a service team is connecting a customer-help system, confirm the Service Account and its current capabilities. Do not assume the same API entitlement simply because both accounts have an inbox.

The account is administered in the WeChat Official Accounts Platform, often called the public platform. Tencent Cloud’s integration guide has the operator log in there, find the Developer ID under Settings and Development > API Management > Basic Configuration, then use the bound administrator’s personal WeChat to approve an external connection. That sequence reveals two different places to audit: the web account settings and the administrator’s personal WeChat approval path. An agency can know the web login details and still be unable to approve a new third-party service if the bound administrator has left.

Before any access change, record the account name, account type, AppID, displayed organization or individual, administrator identity and currently authorized service. Match these to the company that expects to own the customer relationship. Tencent says Official Accounts can be used by individuals or organizations, while its product description positions Service Accounts for businesses (Tencent product overview). Do not infer a mainland or overseas legal-entity entitlement from the English product page. For a cross-border application, check the registration and verification options in the actual account flow before signing an agency agreement.

The bound administrator is the approval point in Tencent’s documented third-party connection flow: the administrator scans the QR code with their personal WeChat and confirms authorization on the phone (Tencent Cloud publishing guide). Tencent’s contact-center integration likewise says the Official Account administrator scans and authorizes the account when it is bound. If an external inbox vendor asks an ordinary staff operator to approve that prompt, stop and confirm who is actually bound as administrator.

An operator is a person doing the ongoing work of providing information and service through the Official Account. Tencent describes the public platform as the place where operators provide information and services to WeChat users in its Official Account API introduction. A content publisher may prepare posts; a customer-service teammate may handle replies. Neither job alone establishes authority to approve a third-party platform in the administrator-scanned flow. Avoid giving out the administrator’s personal WeChat login merely to let someone answer customer messages.

A developer or vendor with an AppID and AppSecret has technical access that does not appear as a human operator seat. Tencent Cloud’s Open Service documentation explains that its gateway uses the stored appId and appSecret to obtain and refresh an access_token. Therefore removing a former operator from the web platform is not enough to establish that a service holding the secret has lost API access. Treat people, administrator approvals and credentials as three entries in the access inventory.

As of November 2026, check the live personnel settings before relying on an old guide’s count of operators or its exact menu layout. Check the current seat limit in your own account settings. The immediate questions for the owner are: which bound people can log in today, who can approve a new integration, and which identities still need access after a team change?

Start with the administrator identity, because the new person’s day-to-day access and a third-party authorization are different requests. Sign in to the Official Accounts Platform and inspect its personnel settings for the bound administrator and operator list. Match each operator to a current job. If a former agency employee appears, plan their removal before you authorize a replacement platform. Do not substitute a shared personal WeChat account for a named operator; it makes the eventual offboarding check ambiguous.

For a new operator, use the personnel-management flow shown inside your account and require the new person to confirm access with their own WeChat. After adding them, have them perform the smallest real task they were hired to do, such as opening a customer request or preparing a draft. If they cannot reach that task, inspect the current role assignment rather than asking the administrator to scan an unrelated third-party QR code. Tencent’s documented QR step is for authorizing an external application, not a blanket fix for a staff member’s missing work access (Tencent Cloud authorization flow).

When responsibilities change, remove the old operator access and repeat the task test from the person’s own session. The administrator should also review connected platforms and developer credentials if that person maintained an integration. For example, a freelance publisher who only drafted content may require a personnel change; an agency developer who also configured a customer-service connector requires a credential and authorization review. Record who made each change and when. Keep a business handoff record even if the console shows recent activity; a missing record can make a later access dispute hard to untangle.

The menu path for developer configuration is documented as Settings and Development > API Management > Basic Configuration in Tencent Cloud’s Official Account publishing instructions. Personnel controls can differ by account and interface language, so use the labels your account displays for operator binding and removal. If the current administrator cannot approve a transfer, resolve that account-control problem with the platform before removing the only reachable operator.

A business may pay an agency to operate its Official Account, but the business should still be able to identify the registered account entity, reach the bound administrator and approve or reject a new connection. Tencent’s authorization example makes the administrator’s scan an explicit part of connecting a third-party customer-service platform. That is a practical recovery test: if the vendor disappeared tomorrow, could someone at the business authorize a replacement from a device they control? If the answer is no, fix that while the current administrator is available.

Verification and a visible trust signal are not the same thing as personnel access. A platform may require account authentication for a particular capability. For example, Tencent Cloud’s Agent Development Platform guide says its Service Account integration needs authentication and that an account still authenticating may fail to receive messages after five seconds in that application. That is a condition for the documented integration, not proof that every Official Account API has an identical verification gate. Check the prerequisite for the particular API or third-party product you intend to use.

For an overseas application, check the registration country and entity fields and the verification requirements presented to your applicant account. Save the resulting account type, applicant entity and approval status in the ownership record. This is especially important when the company has both mainland and overseas teams, because Tencent describes Weixin and WeChat as separate but interoperable sister services intended for mainland and other regions.

If the administrator changes jobs, make the transfer an explicit project. Identify the current bound administrator, the new accountable person, their devices and recovery contact, the connected third-party platforms, and the credentials that must be rotated. Test that the successor can approve a harmless account action before the predecessor loses access. Do not assume that a blue check or a successfully published article proves the successor can authorize a customer-service platform.

A developer should distinguish the AppID from the AppSecret and the resulting access_token. Tencent Cloud directs the operator to copy the AppID from Settings and Development > API Management > Basic Configuration (setup guide). Its Open Service documentation says a gateway with the appId and appSecret retrieves a token from WeChat and renews it when it expires or approaches expiry. Do not put the AppSecret in an agency brief, screenshot or public issue. Keep it in a controlled secret store and record which application uses it.

Tencent Cloud also says to check whether the intended API is available to the account and to set an IP allowlist before calling Official Account APIs (Official Account API notes, Open Service notes). An API failure can therefore mean wrong credentials, missing interface entitlement or an unlisted server IP. Diagnose those separately. For example, rotating the secret repeatedly will not add the new vendor’s egress IP to the allowlist. Record the approved IPs and the service that owns them; review them when an agency migrates infrastructure.

A third-party platform may instead ask the bound administrator to scan a QR code and approve a requested account scope. Tencent Cloud’s contact-center walkthrough shows the account being bound after that mobile approval. Read the authorization screen and confirm the account selected before scanning. If an agency says it needs an Official Account but the prompt names a different account, cancel and investigate. The account owner should keep an inventory of authorized platforms, their business purpose, the approver and the date of the last working test.

During offboarding, remove an unneeded platform authorization in the Official Accounts Platform, replace any secret the old supplier possessed, inspect the IP allowlist, and test a new message through the replacement. Revoke access before deleting the old vendor’s internal project, so the business can still identify the app and callback that were attached. If a connector stops after revocation, that is expected; if it still receives fresh messages, the access map is incomplete. Tencent’s docs describe the authorization and token mechanisms; the exact revocation menu should be confirmed in the live account as of November 2026.

An Official Account is not the same as WeCom. Tencent describes WeCom as an enterprise communication platform with its own applications and APIs; it can connect employees with customers using Weixin. Tencent also says customer relationships in WeCom are owned by the company and preserved when an employee leaves. That is useful for an offboarding decision, but it does not mean a WeCom administrator automatically becomes the bound administrator of an Official Account. Inventory both systems when a team uses both.

WeChat Customer Service can be surfaced through an Official Account menu, Mini Program and other entry points. Tencent Cloud’s customer-service integration guide says the WeCom administrator scans to authorize the WeChat Customer Service connection in that flow. This differs from the Official Account administrator scan used for the Official Account channel in Tencent Cloud’s contact-center guide. If a consultant asks who must approve a new inbox, first ask which product is being connected. The same customer might enter via a public account menu while the approval belongs in WeCom’s customer-service administration.

Tencent Cloud warns in its WeChat Customer Service guide that a third-party management authorization can affect native account management and that an existing hosted service may need to be disconnected before another takes over. Treat that as a handoff check for the WeChat Customer Service product, not a universal rule for every Official Account. Map the entry point, the receiving service and the administrator who can change it. A support team that audits only Official Account personnel may miss a separate WeCom authorization routing those enquiries elsewhere.

Begin the review from the business’s own account inventory: registered Official Account, type, administrator, operators, authorized platforms, AppID, secret custodian and allowlisted IPs. Do not put the secret value in that inventory. Confirm the administrator’s personal WeChat remains reachable and protected; Tencent’s integration instructions make that device the approval instrument (administrator scan). A departed administrator with the only usable phone is an account-control problem, even when customer replies continue through an existing connector.

Next, compare the operator list to the actual publishing and service roster. Ask each remaining operator to sign in with their own account and perform one assigned task. Remove people who no longer need access. Then compare authorized platforms and IP allowlist entries with the current application inventory. Tencent’s API setup notes make the IP allowlist a concrete place to find an abandoned integration. An unfamiliar IP should be investigated against deployment records before it is removed, so a live customer-service endpoint is not interrupted without a replacement.

Finally, send a test enquiry through each real entry point: the Official Account conversation, any menu link to WeChat Customer Service, and any WeCom customer route the business operates. Record where the message arrived and who could answer it. The Tencent Cloud customer-service guide lists Official Account menus and WeCom customer chats as possible entry points; they can land in different administration flows. This exercise catches a stale third-party binding more reliably than an inventory of staff names alone.

For each departure, preserve unresolved customer context, remove the person’s operator access, confirm the administrator remains business-controlled, revoke obsolete platforms, rotate exposed credentials, and repeat the entry-point tests. Keep the record dated. If the account settings provide security or activity history, review it there. Check the session controls actually shown in your own console and keep the dated handoff record regardless.

Treating Subscription and Service as the same setup: a team selects a publishing-oriented Subscription Account, then asks a vendor to configure a Service Account integration. Tencent gives the two types different purposes (Official Accounts); verify the actual account type before contracting for a feature. Using an operator for administrator approval: an agency tells a publisher to scan a third-party QR code. Tencent’s documented binding flow specifies the bound administrator’s personal WeChat (integration guide).

Rotating a token while ignoring the allowlist: a developer gets a new token but the new server still cannot call the API. Tencent’s API notes require an IP allowlist and call-specific permission checks. Removing a person while leaving their integration: a former contractor disappears from the operator list but their service still holds the AppSecret. Review both the personnel list and technical access. Mixing WeCom with the Official Account: a WeCom administrator is asked to approve a normal Official Account binding. Identify whether the prompt concerns WeChat Customer Service or the Official Account itself before choosing the approver.

Regional rules deserve their own check. Tencent identifies Weixin as designed for mainland users and WeChat as designed for users elsewhere (Tencent Weixin and WeChat). If the application is for an overseas entity, capture the current registration choices, verification documents and review status shown to that applicant instead of copying a fee or account cap from an old agency guide. The same discipline applies to payment features: verify the separate product’s eligibility before promising it to the business.