Implementing WeChat OAuth Login with PHP

In web applications, third‑party login such as WeChat improves user experience; this guide shows how to implement WeChat OAuth login using PHP and store the user's nickname and avatar.

Prerequisites: a PHP‑capable environment, a registered WeChat public account with AppID and AppSecret.

Authorization flow:

1. Direct the user to the WeChat authorization URL:

https://open.weixin.qq.com/connect/oauth2/authorize?appid=APPID&redirect_uri=REDIRECT_URI&response_type=code&scope=SCOPE&state=STATE#wechat_redirect

2. After the user consents, WeChat redirects back with a code parameter; exchange it for an access token:

https://api.weixin.qq.com/sns/oauth2/access_token?appid=APPID&secret=SECRET&code=CODE&grant_type=authorization_code

3. (Optional) Refresh the access token when it expires:

https://api.weixin.qq.com/sns/oauth2/refresh_token?appid=APPID&grant_type=refresh_token&refresh_token=REFRESH_TOKEN

4. Retrieve user information (requires snsapi_userinfo scope):

https://api.weixin.qq.com/sns/userinfo?access_token=ACCESS_TOKEN&openid=OPENID⟨=zh_CN

The following PHP function encapsulates these steps and returns the user information array:

/**
 * $appid  string  WeChat AppID
 * $secret string  WeChat AppSecret
 * $code   string  Authorization code returned by WeChat
 */
function getWechatOpenId($appid, $secret, $code) {
    // 1. Get access token
    $get_token_url = 'https://api.weixin.qq.com/sns/oauth2/access_token?appid=' . $appid .
                     '&secret=' . $secret . '&code=' . $code . '&grant_type=authorization_code';
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $get_token_url);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    $res = curl_exec($ch);
    curl_close($ch);
    $json_obj = json_decode($res, true);

    // 2. Refresh token if needed
    $refresh_token = $json_obj['refresh_token'];
    $refresh_token_url = 'https://api.weixin.qq.com/sns/oauth2/refresh_token?appid=' . $appid .
                         '&grant_type=refresh_token&refresh_token=' . $refresh_token;
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $refresh_token_url);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    $res = curl_exec($ch);
    curl_close($ch);
    $json_obj = json_decode($res, true);

    // 3. Get user info
    $access_token = $json_obj['access_token'];
    $openid = $json_obj['openid'];
    $get_user_info_url = 'https://api.weixin.qq.com/sns/userinfo?access_token=' . $access_token .
                         '&openid=' . $openid . '⟨=zh_CN';
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $get_user_info_url);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    $res = curl_exec($ch);
    curl_close($ch);
    $user_obj = json_decode($res, true);
    return $user_obj;
}

Integrate this function into your login flow, update the returned nickname and avatar in your user database, and you have a working WeChat login feature.