Which security setting should I choose?

Custom keywords, with the keyword FishOut. Signing needs a secret that is not part of the webhook URL, and FishOut does not sign for DingTalk; an IP rule fails because FishOut has no fixed sending addresses.

What happens if we hit the 20-a-minute limit?

DingTalk throttles the robot for 10 minutes. FishOut treats that refusal as retryable and tries again after a wait, but the better fix is upstream: leave batching on, which turns a burst into one digest card.

Can an alert @ everyone in the group?

No. DingTalk only mentions phone numbers or user ids listed in the message’s at field, and FishOut always sends it empty with isAtAll false.

Is the alert in Chinese?

Post titles stay in their original language; FishOut’s own words in the card are English. The marketing site and product are not available in Chinese today.

IntegrationsWorkplace chat

Brand mentions in a DingTalk group

A DingTalk custom robot is a URL with an access token, created by anyone who manages the group. It takes an ActionCard with buttons, and it is strict about two things: a security setting the message has to pass, and twenty messages a minute.

Start free Read the alerts docs

Every alert channel is on every plan, including Free.

[01] WHAT LANDS THERE/ A GROUP

A mention, as it arrives in DingTalk

Rendered by the code that sends it, from a sample GitHub post. Never the post body.

群 · Customer voice

FishOut robotnow

FishOut · Relevant mention on GitHub

AcmeMail API returns 429 on bulk label updates

Relevance 86 · Brand · Negative · by lin-wei-dev

Labels: Has a problem

Open in FishOutView on GitHub

[02] CONNECT IT/ SETUP

Point FishOut at a group

3 steps, a few minutes end to end.

1
Add a custom robot to the group
Open the group’s settings, then Group management → Robots → Add robot → Custom. Name it FishOut and pick an avatar.
2
Choose the keyword security setting
DingTalk asks for a security type. Choose custom keywords and enter FishOut. Every FishOut ActionCard title starts with “FishOut · ”, so it always contains the keyword. FishOut does not use the signing option.
3
Copy the webhook and paste it into FishOut
Accept the terms, finish, and copy the webhook. Under Settings → Notifications, add a DingTalk channel and paste it; the URL must carry exactly one parameter, access_token.
robot url
```
https://oapi.dingtalk.com/robot/send?access_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Then set the floor

Twenty messages a minute sounds like plenty until a launch is on Hacker News and every post about it clears a floor of 60. Set 80, keep batching on, and the most a busy five minutes costs the group is two messages: the first mention and one digest card.

Settings · Notifications

DingTalk

https://oapi.dingtalk.com/…

Healthy

Relevance floor60

Eventsmention.scored

Batch bursts5 min

[03] WHAT IS IN IT/ FIELDS

What DingTalk receives, field by field

Built from the event’s envelope and nothing else, so a retry renders exactly the message the first attempt would have.

Field		How
Card title	Shown	“FishOut · ” plus the headline: the line the keyword check reads.
Post title	Clipped	Clipped at 200 characters, link syntax broken so a title cannot fake a link.
Relevance, subject, sentiment, author	Shown	Its own paragraph.
Reply hint and labels	Shown	Their own paragraphs.
Buttons	Shown	Open in FishOut and View on the platform, side by side.
@all	Never	at is always empty and isAtAll false.
Post body	Never	Never sent: the envelope does not carry it.

[04] TEN PINGS OR ONE/ DIGEST

A burst arrives as one message

DingTalk batches by default. Here 3 posts were held after the first; they arrive together when the window closes, best first.

群 · Customer voice · 5-min digest

FishOut robot+5m

FishOut · 3 new mentions for AcmeMail

AcmeMail webhook retries are not idempotent · GitHub · 86
Add Notchmail as a source connector · GitHub · 79
Benchmark: shared-inbox API latency · GitHub · 73

Open in FishOut

[05] WHAT WILL BITE YOU/ LIMITS

DingTalk’s limits, not ours

These are DingTalk’s constraints, checked against the DingTalk Open Platform robot documentation. Failures are tracked per channel, so one broken destination never stops the others.

Each robot can send at most 20 messages a minute to its group. Over that, DingTalk throttles it for 10 minutes and suggests merging alerts into one summary — which is what a FishOut digest is. [source]

Security settings are custom keywords (up to 10, at least one must appear in the message), signing, or IP ranges. FishOut works with keywords. [source]

Refusals come back as an errcode in the body: 310000 for a failed security check, 410100 for sending too fast, 400101 for an unknown token. FishOut reads it before recording a delivery. [source]

An ActionCard can carry separate buttons, each with its own link; FishOut sends two, laid out side by side. [source]

In the channel’s delivery history
You see	It means	Do this
dingtalk_security_check_failed	errcode 310000: keyword, signature or IP check failed.	Set the keyword to FishOut and turn off signing and IP rules.
dingtalk_robot_disabled	errcode 400101/400102: the token is unknown or the robot is off.	Re-enable the robot, or create a new one and paste its URL.
dingtalk_rate_limited	errcode 410100: over 20 a minute. Retried after the throttle.	Leave batching on; raise the floor if it keeps happening.