TikTok API

TikTok for Developers is the platform’s own developer portal. A registered app gets a client key and secret, plus the products it may use for TikTok accounts: Login Kit for sign-in, the Display API for reading, the Content Posting API for publishing.

Each product is a separate approval track with its own scopes.

Login Kit: OAuth 2.0 on four platforms

Login Kit is TikTok’s OAuth 2.0 implementation for iOS, Android, desktop and web. The app sends the user to the authorization URL with client_key, scope, redirect_uri, state and response_type=code, then exchanges the returned code on its own server.

• A web redirect URI must be https, absolute and static, at most ten of them.
• Desktop, iOS and Android also require PKCE; the client secret and the refresh token stay server side.

Tokens: 24 hours and 365 days

The token endpoint takes a urlencoded body: client_key, client_secret, code, grant_type, redirect_uri, plus code_verifier under PKCE. The access_token lasts 24 hours and the refresh_token 365 days. Refreshing needs no user consent, and the response may return a new refresh_token that replaces the stored one.

Display API: data for the authorised account

Three endpoints: user info returns profile fields such as open_id and display name, video list pages through recent videos, and video query looks videos up by id. The scopes are user.info.basic and video.list, and data returns only for the account that authorised the app. The documented limit is 600 requests per endpoint in a one minute sliding window, past which the response is HTTP 429.

Content Posting API: two publishing paths

Direct Post publishes to the creator’s profile and needs the video.publish scope. Upload drops a draft in the creator’s inbox and needs video.upload, finished by the creator in the TikTok app. Photo posts use a separate endpoint and must pull from a URL.

The flow is asynchronous: creator info comes first, because the privacy level may only be one of the values returned for that creator; then the init call, the chunked upload for FILE_UPLOAD, and status polling or a webhook. The init endpoint allows 6 requests per minute per access token, status reports 30.

Audit, sandbox and documented limits

• Until a client passes the audit, Direct Post content is private only, the posting account must be private, and at most 5 users may post in a 24 hour window; the error is unaudited_client_can_only_post_to_private_accounts.
• Two caps remain: a 24 hour active creator cap per client, derived from the audit form estimates, and roughly 15 posts per creator per day, shared across all clients.
• Submissions move through Draft, In review, Live and Not approved, and need at least one demo video of up to 50 MB.
• Sandbox mode allows five sandboxes and ten target users each, but no Content Posting API access for public videos.
• PULL_FROM_URL needs a verified domain or URL prefix, otherwise the response is url_ownership_unverified.
• Media limits: MP4, WebM or MOV with H.264, 23 to 60 fps, 360 to 4096 pixels per side, 4 GB and 10 minutes maximum; photos are WebP or JPEG up to 1080p and 20 MB. The docs do not break the products down by country: access depends on which scopes your app was approved for.

Our publishing chain starts from an n8n workflow, the media is served from our own domain, and the release is reachable through Postiz and the Hermes agent.

Further reading

• Get Started - Direct Post
• Content Sharing Guidelines
• Login Kit Overview

At CyberElectro the TikTok API is one output of the publishing chain: creator info checks and post status tracking are as much part of the flow as the upload.