TikTok API Integration: Build It Into Your Product

A TikTok API integration for a product has six parts: an approved TikTok app, a connect flow where each of your users authorizes their own TikTok account, token storage and refresh, media hosting TikTok can pull from, publishing that follows each creator's settings, and status tracking. The publish call is the smallest of them. This guide walks through all six for a multi-tenant product, the kind where your users bring their own accounts.

If you only need the publishing calls, read how to post to TikTok via API. This post is about the whole integration around them.

What does a TikTok API integration involve?#

A TikTok API integration involves an approval track and a build track. The approval track is TikTok's: registration, app review, and on TikTok for Developers a separate audit before posts go public. The build track is yours: OAuth, tokens, media, publishing, and the status and error handling that keep your users from seeing a generic failure.

Which TikTok API should your product use?#

Your product should use TikTok for Developers if users post their own content, and TikTok API for Business if you manage accounts for brands or clients. The two are separate portals with separate reviews. The full comparison is in TikTok API for Business vs TikTok for Developers.

We picked TikTok API for Business for Adeli because it covered more of what our customers asked for: comment moderation, Business and personal accounts, explicit permission for software vendors building for other businesses, and a per-minute request limit instead of a cap on how many accounts can post each day. Comment management was the feature customers cared about most.

What do you need before you start?#

• A TikTok developer account on the portal you chose, tied to a company domain with working email.
• A registered app with the posting product added and the scopes your features use: video.publish for direct posts, video.upload for drafts, user.info.basic to identify the account.
• A privacy policy and terms of service on your own domain. Reviewers open them.
• An HTTPS redirect URI registered in the portal.
• A domain or URL prefix you can verify with TikTok, if TikTok will pull your media from a URL.

Getting through registration and review is covered step by step in how to get TikTok API access.

Step 1: Get your TikTok app approved#

Submit the app for review with a demo video that shows TikTok's real consent screen and every scope you request. TikTok's getting-started FAQ says app review "may take several days to two weeks".

On TikTok for Developers, approval doesn't make posts public. Until your app passes the Content Posting API audit, TikTok's Content Sharing Guidelines limit it to:

• SELF_ONLY posts, visible only to the creator.
• Private accounts only. A public account gets unaudited_client_can_only_post_to_private_accounts.
• 5 posting users per 24 hours.

Build and test inside those limits, then apply for the audit. Each new scope you add later goes back through review.

Step 2: Connect each user's TikTok account with OAuth#

Each of your users authorizes their own TikTok account, and your server exchanges the returned code for that user's tokens. Send the user to TikTok's authorize page with your client key, the scopes, your redirect URI, and a state value you check on the way back:

https://www.tiktok.com/v2/auth/authorize/?client_key=<CLIENT_KEY>&response_type=code&scope=user.info.basic,video.publish&redirect_uri=<REDIRECT_URI>&state=<STATE>

Then exchange the code from your server:

curl --location --request POST 'https://open.tiktokapis.com/v2/oauth/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_key=<CLIENT_KEY>' \
--data-urlencode 'client_secret=<CLIENT_SECRET>' \
--data-urlencode 'code=<CODE>' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'redirect_uri=<REDIRECT_URI>'

Store the response against your user record as well as the TikTok open_id. Check the returned scope list too. A user can grant fewer scopes than you asked for, and the publishing call fails later if video.publish is missing.

Step 3: Store and refresh tokens for every account#

A TikTok access token lasts 24 hours, so every connected account needs an automatic refresh. The token response includes expires_in (86400 seconds) and a refresh_token that lasts a year. Refresh before expiry:

curl --location --request POST 'https://open.tiktokapis.com/v2/oauth/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_key=<CLIENT_KEY>' \
--data-urlencode 'client_secret=<CLIENT_SECRET>' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=<REFRESH_TOKEN>'

At scale, three rules matter:

• Save the new refresh token every time. TikTok may return a different one, and the old one stops working.
• Lock the row while refreshing. Two workers refreshing one account at once can each rotate the token, and one of them loses.
• Mark the account for reconnect when refresh fails. Show your user a reconnect prompt instead of failing posts silently.

More detail, including the business-portal token flow, is in the TikTok access token guide.

Step 4: Host media where TikTok can pull it#

TikTok pulls media from a URL on a domain or URL prefix you've verified in the developer portal. The Content Posting API also accepts chunked file uploads for video. The Accounts API on TikTok API for Business pulls from a URL only.

• Verify the exact prefix. Photos always come from a URL, so a URL on an unverified domain fails.
• Don't redirect. Serve the file at the URL you send. A redirect can make TikTok reject the media.
• Check the file, not its name. Confirm the actual format and duration before publishing. The creator's maximum duration comes from Step 5.
• Strip editor tags. Videos exported from editors such as CapCut carry metadata that TikTok reads to add an editor attribution link to API posts. Remove those MP4 boxes if your users don't want the link.

Step 5: Publish with each creator's settings#

Query the creator's info before every post, then publish with values from that response. On the Content Posting API, creator_info/query returns the privacy levels this creator can use, whether comments, Duets, and Stitches are off, and their maximum video length:

curl --location --request POST 'https://open.tiktokapis.com/v2/post/publish/creator_info/query/' \
--header 'Authorization: Bearer <USER_ACCESS_TOKEN>' \
--header 'Content-Type: application/json; charset=UTF-8'

Your posting screen should show the creator's nickname and offer only the returned privacy levels. A value outside that list fails with privacy_level_option_mismatch. Then initialize the post with PULL_FROM_URL or FILE_UPLOAD. The full request sequence is in how to post to TikTok via API, and the differences between publishing and sending drafts are in the TikTok Direct Post API guide.

Each creator account can post around 15 times a day through the API, and audited apps also get a daily cap on active posting users.

Step 6: Track status, analytics, and comments#

A successful publish call means TikTok accepted the post, not that it's live. Poll status/fetch with the publish_id, or subscribe to TikTok's webhooks, and report the result to your user per account.

• Status. Show "processing", then "published" or the failure reason TikTok returns.
• Analytics. TikTok for Developers returns lifetime counts. TikTok API for Business adds daily metrics, watch time, and demographics. See the TikTok analytics API guide.
• Comments. Reading and replying to comments needs TikTok API for Business. See the TikTok comments API guide.

Is the TikTok API free to integrate?#

TikTok doesn't charge for its posting APIs, but a TikTok API integration still costs engineering time and approval time. Pricing details are in is the TikTok API free.

Is there a faster way to build a TikTok API integration?#

Adeli is a unified social media API that already holds an approved TikTok app, so your product skips TikTok's app review and audit. Adeli publishes through TikTok API for Business, refreshes every connected account's tokens, and keeps up with TikTok's changes. Your users connect their own TikTok accounts and you publish with one API key.

Start a connection for one of your users:

curl -X POST https://app.tryadeli.com/api/v1/profiles/<PROFILE_ID>/connect \
  -H "Authorization: Bearer $ADELI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "platform": "tiktok", "redirectUrl": "https://yourapp.example/callback" }'

Then publish to the connected account:

curl -X POST https://app.tryadeli.com/api/v1/posts \
  -H "Authorization: Bearer $ADELI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "platform": "tiktok",
    "accountId": "<ACCOUNT_ID>",
    "tiktok_title": "New drop is live #launch",
    "music_usage_confirmed": true,
    "video": { "url": "https://cdn.yourapp.example/launch.mp4" }
  }'

What Adeli takes off your list:

• Review and audit. Adeli holds the approved app, so there's no private-only phase for your users.
• Tokens. Adeli stores and refreshes tokens per account and flags the ones that need a reconnect.
• Media. Adeli stages each file on its own verified media host, checks the real format, normalizes photos to JPEG, and strips CapCut attribution tags from MP4s before TikTok pulls them.
• Status and errors. Every publish returns a per-platform status you can poll. Adeli logs every call it makes to TikTok, with the status, latency, and TikTok's error code, so when a post fails, a person at hello@tryadeli.com can tell you why.

The same API key publishes to Instagram, Facebook, YouTube, X, Bluesky, and LinkedIn through Adeli's posting API. The TikTok API page lists what Adeli supports on TikTok, and the publish endpoint docs have every field.