I. The Role of Trusted Domain

1. OAuth2 web authorization feature
2. Calling of jssdk
3. You need to set a trusted domain to remove the security risk warning on the WeChat side.

II. Requirements for Setting Trusted Domain

1. The trusted domain set cannot include the protocol header, does not support IP addresses, short-link domains, or domains containing underscores. Wildcard domain configuration is not supported

2. Domains support first-level, second-level, and third-level domains. If the first-level domain has been filed, and you are using a second-level domain, then the second-level/third-level domain does not require filing.
Setting up a trusted domain requires filing; to remove the risk warning on the WeChat side, filing is also necessary.

3. One domain can be associated to different apps.

4. When verifying a trusted domain, it prompts “Domain ownership not passed”. You can click View the solution.

5. After the domain filing is successful, it is recommended to associate and use it 72 hours after the filing is successful.

6. The trusted domain associated to the app must be verifiable on the website of MIIT (Ministry of Industry and Information Technology).

7. When setting a trusted domain, only one “callback domain that can be used for OAuth2.0 web page authorization feature” can be set, and “trusted domains that can call JS-SDK and redirect mini programs” can be set up to 10.

8. Currently, port 10080 has been included in the blocklist for browsers, and mainstream browsers do not support this port. If you are using this port, it is recommended to deploy the website on a different port.

9. Setting a trusted domain -> Can be used as the callback domain for the app’s OAuth 2.0 web authorization feature: Supports configuration with Chinese domain transcoding.
Set Message Reception -> Set API Reception -> Receive Message Server Configuration -> URL: Supports configuration with Chinese domain transcoding.
Note: Custom apps -> Receive Messages -> Set API to Receive Messages -> The URL configured for the message receiving server does not support writing IP addresses.
If the domain is a Chinese domain, it is recommended to fill in the domain converted using a transcoding tool.

10. If the enterprise is in a verified status, but after configuring a trusted domain, it becomes “uncertified”, which does not affect the use of already associated trusted domains for the time being.

11. The domain ownership file cannot be deleted after verification, as deletion may affect usage.

12. Each second-level domain needs to undergo ownership verification, and the verification file must be placed in the root directory of the domain.