TikTok

TikTok uses Login Kit for web and the Content Posting API. The product does not post by opening tiktok.com.

What you can send

Kind	What happens
Video (direct post)	Posted with the privacy and interaction choices on the composer.
Inbox upload	TikTok accepts the file and notifies the creator. The outcome is handed to the app. The creator finishes it from the TikTok inbox. At most 5 inbox uploads can be pending in 24 hours.

One video per post. MP4, WebM, or MOV. Up to 4 GB. Frame rate 23 to 60. Width and height each from 360 to 4096 pixels. The caption is TikTok’s title, at most 2,200 UTF-16 code units, hashtags included. Every creator can post at least 3 minutes. Some can post 5 or 10. This product will not send more than 10 minutes, and creator info can require less.

Direct post and inbox init are each limited to 6 requests per minute per user token. Creator info is 20 per minute. Status is 30 per minute. A creator’s direct-post cap is typically about 15 posts per 24 hours and is shared across API clients. TikTok decides the exact cap.

Unaudited apps stay private

Until TikTok approves the app, the only privacy level is Only me (SELF_ONLY). The creator’s account has to be private at the time of posting. An unaudited app can post for at most 5 users in 24 hours. Public, friends, and followers are rejected. Branded content cannot be private, so it is unavailable in this mode.

TIKTOK_APP_AUDITED is the only switch that lifts that rule. Set it to true or 1 only after the audit. Then the composer offers the privacy levels TikTok returned for that creator. There is no default. The placeholder is “Select who can view this video”.

After an audit, a creator can make an older private video public in the TikTok app by switching the account to public and then setting that video to Everyone.

What the composer must show

These rules come from TikTok’s Content Sharing Guidelines. The composer and the worker use the same checks.

• The creator’s nickname, so it is obvious which account receives the video.
• A privacy menu with nothing selected until the person chooses.
• Allow comment, Allow duet, and Allow stitch, all off until the person turns one on. A choice the creator disabled in TikTok is unavailable, with the reason.
• Disclose commercial content, off until the person turns it on. Then Your brand and Branded content appear. Branded content stays unavailable while the only privacy is Only me.
• The line “By posting, you agree to TikTok’s Music Usage Confirmation”, linked to Music Usage Confirmation. Branded content also names the Branded Content Policy.
• A note that the video can take a few minutes to appear on the profile.

Saving a draft is allowed while those choices are unfinished. Submit for review stays off until the person has chosen who can view the video and agreed to the music confirmation. It also stays off when the video is longer than the creator’s maximum, when commercial disclosure is turned on and left unfinished, or when TikTok says this creator cannot post right now.

TIKTOK_POSTING_PREVIEW=1 loads sample creator info so you can look at the screen on a machine with no live TikTok account. It does not call TikTok. Leave it unset on a server that can post.

Set up the TikTok app

1. Create an app from TikTok for Developers. Register your app is the setup guide.
2. Put the client key and secret in TIKTOK_CLIENT_KEY and TIKTOK_CLIENT_SECRET.
3. Add Login Kit and the redirect URI from Accounts. TikTok allows at most 10 URIs, each shorter than 512 characters, absolute, starting with https, with no query string and no fragment.
4. Add the Content Posting API, including direct post.
5. Request user.info.basic, video.publish, and video.upload. Publish and upload stay unavailable until TikTok approves them for the app. A creator cannot grant a scope the app has not been given. Scope names are in the scopes reference.
6. Use a sandbox while you integrate. Sandbox mode does not offer the Content Posting API for public videos.

For a file TikTok should download, verify the domain under the app’s URL properties. The file URL has to be https and must not redirect. Set MEDIA_PUBLIC_ORIGIN and MEDIA_SIGNING_KEY, or the product uploads the file itself.

A first private proof uses a private TikTok account, privacy Only me, and a short MP4.