How to Build a 24/7 DingTalk AI Employee in 4 Steps: A Practical Cloud Deployment Guide with Clawdbot

How can you build a DingTalk AI digital employee that works 24/7 with minimal cost and the simplest process? The answer lies in leveraging Alibaba Cloud’s infrastructure and large model capabilities through Clawdbot, an automation solution that quickly constructs an intelligent robot capable of participating in group chats and private conversations. Based strictly on technical deployment documentation, this guide will walk you through the entire process from environment preparation to going live.

Why You Need a DingTalk AI Employee

It is not just a chatbot; it is an automation tool to boost productivity. Through Clawdbot, you gain a digital assistant capable of working around the clock, supporting both @mentions in group chats and private chat interactions, significantly reducing the burden of repetitive tasks.

It can solve core pain points in three specific scenarios:

Effortless Daily Updates: For content creators or operations staff, tracking hot topics, drafting initial posts, and formatting content are high-frequency needs. An AI employee can automatically track trends and assist in writing, ensuring account activity and completely eliminating “update anxiety.”
Instant Idea Deployment: For developers and product managers, a morning inspiration is often delayed by complex environment setups. An AI employee can assist in quickly generating code or pages, allowing a new website or prototype to go live by the afternoon, enabling rapid validation of ideas.
Automated Release Updates: In scenarios with frequent product iterations, manually syncing Release Notes to social platforms like Weibo is tedious and error-prone. An AI employee can automatically fetch version information and publish it, ensuring timely and accurate information delivery.

Reflection & Insights

Before diving into the deployment process, I’ve observed that traditional AI app deployments often get stuck on environment configuration and API integration. Clawdbot’s design philosophy is very pragmatic—it encapsulates complex Docker container orchestration and DingTalk Open Platform interactions into a one-click script. This “plug-and-play” approach is exactly what individual developers and small teams need most. Our focus should not be on underlying network protocols, but on how to quickly build a business closed-loop using this tool.

Solution Architecture & Technology Selection

To implement the above functions, this solution adopts a lightweight but complete technical architecture, composed mainly of two parts: compute resources and model services.

1 ECS Instance: As the physical carrier, used to deploy the core Clawdbot services. The cost-effective e instance is recommended, as it is sufficient to handle the bot’s message forwarding and logic processing.
Bailian Model Service: As the “brain,” it utilizes APIs from the Alibaba Cloud Bailian large model platform to generate reply content, endowing the robot with understanding and dialogue capabilities.

The benefit of this architecture is the decoupling of computing and intelligence. The frontend handles message flow, while the backend handles logic reasoning, connected securely via API keys.

Step 1: Create a DingTalk Application & Obtain Credentials

To get the bot onto DingTalk, you must first “register” it on the DingTalk Open Platform. The core of this step is obtaining the robot’s legal identity credentials—Client ID and Client Secret.

Select or Create an Organization

Core Question: What permissions do I need to develop a DingTalk bot?

You need to have developer permissions for an organization. Without them, you cannot create an application.

Log in to the DingTalk Open Platform. Upon logging in, the system will prompt you to select an organization where you have developer permissions.
If you find that the currently logged-in account does not have developer permissions for any organization, or if you want to test in a standalone environment, you can create a new organization directly.
Use the DingTalk mobile app to scan the QR code provided on the platform to quickly complete the organization creation. This is the fastest way to start without cumbersome approval processes.

Create & Configure the Bot Application

Core Question: How do I configure a bot app that supports streaming responses?

Creating the app and enabling the robot capability is key to deployment. The specific configuration options determine the robot’s future interaction experience.

Log in to the Open Platform and select Application Development from the top menu bar.
Click Create App on the right side, fill in the App Name (e.g., “AI Assistant”) and description, then click Save. The system will automatically enter the App Details page.
On the Add App Capabilities page, select to add a Robot.
In the robot configuration page, be sure to turn on the Robot Configuration switch and fill in required fields like the robot name.
Critical Configuration: Set the Message Receive Mode to the default Stream Mode. Streaming mode means that when users receive a reply, the text appears word-by-word like a typewriter, offering a significantly better interaction experience than waiting for the full generation to complete before displaying.
After configuration, click Publish.

Obtain Credentials & Publish the App

Core Question: How do I make the bot officially available within the organization?

Creation is just a draft; publishing is going live. Meanwhile, you need to save your “keys.”

Click Credentials & Basic Info in the left navigation bar. This displays the Client ID and Client Secret. Be sure to copy and save these two strings securely. They must be filled in during server deployment later; otherwise, the robot cannot pass identity verification.
Next is the publishing process. Click Version Management & Release in the left navigation bar.
Click Create New Version, fill in the version number (e.g., 1.0.0).
Set the visibility scope. For the initial test, it is recommended to select Only Me to avoid disturbing colleagues.
Click Save and confirm the release. At this point, your robot is ready in the DingTalk backend.

Step 2: Obtain Bailian API Key & Configure Base URL

Core Question: How do I connect the Alibaba Cloud Large Model as the bot’s brain?

The robot needs to call the Large Model API to generate replies, so a valid API Key must be configured. Please note that while the documentation mentions Coding Plan, in general deployment, we need to ensure the accuracy of the Base URL to guarantee service stability.

Purchase or Obtain Permissions

To control costs during the initial experience, Coding Plan is an option, but it offers limited quotas and specific model restrictions (e.g., only applies to specific region’s qwen3-max models). If you are in a free trial or general scenario, it is recommended to use the standard Bailian API Key directly.

Follow the guidelines to enter the relevant purchase or management page.
Generate and save the API Key. This key will allow your server to initiate questions to the large model on your behalf.

Critical Configuration: Setting the Base URL

When the deployment script runs, it will ask for the “Bailian Base URL.” This is a step prone to errors.

Important Note: The default value is sometimes not applicable to all scenarios. Based on actual deployment experience, to ensure compatibility and stability, please manually input the following general Base URL:
https://dashscope.aliyuncs.com/compatible-mode/v1
Stability Warning: Trial modes (including certain restrictive packages) can be extremely unstable. In formal production environments or tests requiring high reliability, it is recommended to use a standard commercial API Key to avoid service errors (like the 401 errors that may appear in subsequent logs) caused by quota refreshes or restrictions.

Step 3: Prepare Cloud Server (ECS)

Core Question: How do I build a runtime environment in the cloud?

All code and logic need a runtime environment. We will use Alibaba Cloud ECS (Elastic Compute Service) and install Docker to run Clawdbot.

Purchase an ECS Instance

For individual developers or lightweight applications, the e instance is the most cost-effective choice.

Visit the Alibaba Cloud ECS product page and find the e instance package (usually 2 vCPU, 2 GB RAM, starting from ¥99/year).
When configuring parameters, please refer to the following suggestions:
- Region: Choose the region closest to you or your target users, such as China East 1 (Hangzhou). This reduces network latency.
- Image: Be sure to choose Alibaba Cloud Linux 3. This is an optimized Linux distribution with excellent compatibility.
- Public IP: Ensure the instance is assigned a public IP; otherwise, you cannot connect remotely, and the robot cannot perform callbacks.

Connect to the Server

Once the instance is created, you need to operate via a terminal.

Enter the ECS Management Console and find the target instance.
Click Remote Connection and select Workbench Remote Connection.
Click Immediate Login and select Password-free Login to enter the web-based terminal interface directly. This is often more convenient than using a local SSH tool as it requires no key management.

Install Docker Environment

Clawdbot is deployed based on Docker containers, so you need to install Docker and Docker Compose first.

In the Workbench terminal, execute the following commands in sequence:

# 1. Configure Docker CE software source
sudo wget -O /etc/yum.repos.d/docker-ce.repo http://mirrors.cloud.aliyuncs.com/docker-ce/linux/centos/docker-ce.repo
sudo sed -i 's|https://mirrors.aliyun.com|http://mirrors.cloud.aliyuncs.com|g' /etc/yum.repos.d/docker-ce.repo

# 2. Install Docker and Docker Compose
sudo dnf -y install dnf-plugin-releasever-adapter --repo alinux3-plus
sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 3. Start Docker and set it to start on boot
sudo systemctl start docker
sudo systemctl enable docker

After installation, use the following command to verify success:

docker --version && docker compose version

If version numbers are displayed, the environment is ready.

Reflection & Insights

Many beginners get stuck on the speed of image sources during this step. The commands provided in the documentation have already replaced the source with Alibaba Cloud’s internal mirrors.cloud.aliyuncs.com. This is a critical detail. While downloading from official sources is excruciatingly slow, this pre-configured mirror source can save a massive amount of deployment time. This reflects the “details make the difference” aspect of technical documentation.

Step 4: Deploy and Verify the Bot

Core Question: How do I get the code running on the server and connected to DingTalk?

This is the final and most exciting step. We will run the deployment script, enter the prepared credentials, and watch the containers start.

Execute the Deployment Script

Clawdbot provides a one-click deployment script that greatly simplifies the process.

Execute in the terminal:

curl -fsSL https://aliyun-tech-solution.oss-cn-hangzhou.aliyuncs.com/clawdbot/quickstart.sh -o quickstart.sh && bash quickstart.sh

The script will prompt you to enter information one by one. Please fill in accurately:
- DingTalk Client ID: Paste the value obtained in Step 1.
- DingTalk Client Secret: Paste the value obtained in Step 1.
- Bailian Base URL: Remember, just pressing Enter might not be the best option; please enter https://dashscope.aliyuncs.com/compatible-mode/v1.
- Bailian API Key: Paste the value obtained in Step 2.

The script will automatically create directories, generate configuration files, pull Docker images, and start the service. The process may take a few minutes depending on network speed.

Confirm Service Status

After deployment, first check if the containers are running normally.

cd ~/clawdbot-dingtalk && docker compose ps

You should see two containers with the status Up:

clawdbot-gateway
clawdbot-dingtalk-bridge

If the status is not Up, it means the startup failed, and you need to check the logs for troubleshooting. At this point, please be sure to save the Gateway Token output by the script; it is the key to your future backend management.

Test the Bot in DingTalk

Core Question: How do I verify the bot truly understands what I’m saying?

Open the DingTalk client and enter a group chat.
- Note: The group chat’s affiliated organization must match the organization where the robot app was created. If the organizations do not match, you will not find this robot. If unsure, it is recommended to create a new group, and the system will automatically match the current organization.
Click Group Settings (top right corner) -> Add Robot.
Find the robot you created (e.g., “AI Assistant”) in the list and click Add.
Type @AI Assistant Hello in the group chat.
If the robot replies, congratulations, the deployment is successful!
Private Chat Test: You can also click directly on the robot’s avatar in the group chat to enter the single-chat dialogue box. In private chat, you don’t need to @ it; just send a message directly.

Advanced Management: Accessing Control UI & Remote Browser

Beyond basic chat functionality, Clawdbot offers a powerful backend management interface and even supports remote browser operations.

Accessing Control UI

Core Question: How do I securely manage the backend without exposing public ports?

For security reasons, the backend management interface is usually not directly exposed to the public internet. We need to access it via SSH tunneling (port forwarding).

Execute the following command in your local computer’s terminal (not the server terminal):
```
ssh -L 18789:127.0.0.1:18789 -L 18800:127.0.0.1:18800 root@<Your_ECS_Public_IP>
```
This command establishes two tunnels:
- 18789: Used to access the Clawdbot Gateway (Console).
- 18800: Used to access the CDP Remote Browser.
After the connection is established, access in your local browser:
http://127.0.0.1:18789/?token=<YOUR_GATEWAY_TOKEN>
The Token here is the one you saved during deployment, or it can be viewed via the command grep CLAWDBOT_GATEWAY_TOKEN ~/clawdbot-dingtalk/.env.

Remote Control Browser to Login to Sites

This is a very cool advanced feature. If the robot needs to access internal sites that require login (like the company backend or Alibaba Cloud Console), you can remotely control the server’s browser using your local Chrome.

Ensure the SSH tunnel is connected (including port 18800).
Type chrome://inspect/#devices in your local Chrome browser address bar.
Click Configure…, add localhost:18800, and click Done.
Find the remote browser page in the Remote Target list and click inspect.
The DevTools window that pops up is now the console controlling the Chrome on the server. Actions like clicking login or entering verification codes inside it will be executed on the server, and the login state will be preserved.

Common Issues & Troubleshooting

In actual operation, various problems are inevitable. Here are diagnoses and solutions for common errors.

What if the Bot Doesn’t Reply?

First, check the container status to ensure the service is alive.

docker compose ps

If the container is Up but unresponsive, or restarting frequently, check the logs.

docker compose logs dingtalk-bridge --tail=50

Based on the error information in the logs, there are usually the following situations:

invalid client_id or invalid client_secret:
- Cause: DingTalk credentials were entered incorrectly.
- Solution: Run the configuration modification command bash quickstart.sh config and choose to reconfigure DingTalk credentials.
unauthorized:
- Cause: API Key is invalid or expired, or the Base URL is configured incorrectly.
- Solution: Run bash quickstart.sh config to check and correct the API Key and Base URL.
Organization Mismatch:
- Cause: The group chat’s affiliated organization does not match the robot’s development organization, or the group chat is not an internal group.
- Solution: Ensure the group organization is correct or convert the group to an internal group.

Modifying Models and Configurations

If you find the default model does not meet your needs, or if you need to switch API Keys, there is no need to redeploy; use the configuration script directly.

bash quickstart.sh config

The script will pop up a menu:

Bailian API Key
Bailian Base URL
Model
DingTalk Credentials
Modify All

Select the corresponding number to modify. Modifying the model or API Key usually takes effect without restarting the container, but modifying DingTalk credentials will trigger an automatic restart.

How to View Real-time Logs?

To monitor the robot’s running status, you can use the streaming log command:

docker compose logs -f --tail=100

Press Ctrl+C to exit monitoring.

Regarding the HTTP 401 Error in Logs

In the logs, you might see an error like this:
HTTP 401: invalid access token or token expired

This clearly indicates an authentication failure. Combined with the deployment experience earlier, this is usually because:

An extra space was included when entering the API Key, or it was copied incompletely.
An incompatible Base URL was used (e.g., using a standard URL in a trial package, or vice versa).
The account is out of balance, causing the Key to be suspended.

The solution is still to check the credential configuration in bash quickstart.sh config.

How to Update the Service?

When Clawdbot releases a new version, you can quickly upgrade with the following commands:

cd ~/clawdbot-dingtalk
docker compose pull
docker compose up -d

This will pull the latest image and restart the service.

How to Stop the Service?

If you need to pause the robot, execute:

cd ~/clawdbot-dingtalk && docker compose down

Practical Summary / Action Checklist

To facilitate your quick review, here are the core operational points of the entire deployment process:

Preparation Phase:
- [ ] Ensure you have DingTalk Developer Permissions (or create a new organization).
- [ ] Purchase ECS (Alibaba Cloud Linux 3), install Docker.
- [ ] Obtain Bailian API Key.
Configuration Phase:
- [ ] Create the app on DingTalk Open Platform, enable Robot, select Stream mode.
- [ ] Record Client ID and Client Secret.
- [ ] Publish the app version.
Deployment Phase:
- [ ] Run curl ... quickstart.sh.
- [ ] When entering credentials, manually confirm the Base URL is https://dashscope.aliyuncs.com/compatible-mode/v1.
Verification Phase:
- [ ] Check docker compose ps status is Up.
- [ ] Add the bot in a DingTalk group and test @reply.
Maintenance Phase:
- [ ] Use docker compose logs -f to view logs.
- [ ] Use bash quickstart.sh config to modify settings.
- [ ] Access the management backend via SSH tunnel at 127.0.0.1:18789.

One-Page Summary

Core Goal: 24/7 DingTalk AI Employee.
Key Components: Aliyun ECS + Docker + Clawdbot + DingTalk Open Platform + Bailian Large Model.
Required Info: Client ID, Client Secret, API Key, Base URL (https://dashscope.aliyuncs.com/compatible-mode/v1).
Interaction Modes: Group @mention Bot, Private Chat.
Standout Features: One-click deployment script, SSH tunnel backend management, remote browser login.
Common Errors: 401 Authentication Failures (Check Key), Bot Not Found (Check Organization), Container Down (Check Logs).

Frequently Asked Questions (FAQ)

Which large models does Clawdbot support?
It primarily supports models from the Alibaba Cloud Bailian platform, such as qwen3-max, qwen-turbo, etc. The specific model depends on the model name you fill in during the configuration script.
Why is there no response when I @mention the bot in the group?
Please check three things: Does the group chat’s affiliated organization match the one where the bot was created? Has the robot been successfully published and added to that group? Is the Docker container status Up?
What does it mean that the trial mode is extremely unstable?
It means API responses might time out or report errors frequently, or usage might be blocked during specific periods due to quota restrictions (e.g., refreshing every 5 hours). It is recommended to use a formal API Key for production environments.
How do I change the bot’s avatar or name?
This needs to be done on the DingTalk Open Platform’s App Details page. After modification, you may need to republish the version or wait some time for it to take effect.
Can I add the same bot to multiple groups simultaneously?
Yes, as long as the robot’s app release scope covers the organizations these groups belong to, it can be added and used in any number of group chats.
What if the SSH tunnel connection drops?
The SSH tunnel disconnecting only means you lose access to the local management interface (127.0.0.1:18789); it does not affect the normal operation of the robot on the server. Re-executing the SSH command will restore the connection.
What should I do if I get a Permission denied error running the deployment script?
Please ensure you have sufficient permissions before executing the script. You can try adding sudo before the command or check write permissions for /etc/yum.repos.d/.
I accidentally lost the Gateway Token. What should I do?
You can re-view it at any time on the server using the command grep CLAWDBOT_GATEWAY_TOKEN ~/clawdbot-dingtalk/.env.