Reacher Carmela
TikTok API Guide: Products, Access, and Safe Integration
Understand TikTok's Display, Content Posting, Research, webhook, and Shop APIs—plus authorization, review, limits, privacy, and architecture.
TikTok API architecture and governance
The TikTok API is not one unrestricted interface for profiles, content, commerce, and analytics. TikTok offers separate products for specific users and purposes. Each product has its own eligibility, app review, scopes, consent, data limits, and operating rules. A sound integration starts by choosing the narrowest official product for the job—not by collecting whatever is technically visible on the public web.
This guide reflects official documentation reviewed on August 16, 2026. Products, scopes, limits, audit requirements, and regional availability can change. Confirm every production decision in the current TikTok for Developers or TikTok Shop Partner Center documentation.
Key takeaways
- Display, Content Posting, Research, webhooks, and TikTok Shop APIs serve different purposes and authorization models.
- A developer account alone does not grant production data access; apps, products, scopes, and users may each require approval or consent.
- Tokens and client secrets belong on the server, with least-privilege scopes, rotation, revocation, and deletion workflows.
- Rate limits are endpoint-specific and volatile; build queues, backoff, idempotency, and monitoring instead of hard-coded assumptions.
- Reacher supports TikTok Shop creator operations but does not provide a general TikTok API or bypass platform access controls.
Map the TikTok API products before building
Start with the user action and the minimum data required. Similar names do not make the products interchangeable.
| Product | Primary purpose | Access boundary | Not a substitute for |
|---|---|---|---|
| Display API | Display an authorized user's basic profile and eligible TikTok video metadata | Login Kit, approved products and scopes, and user consent | Broad creator discovery or unrestricted public-data collection |
| Content Posting API | Let an authorized user upload a draft or post content through an approved app | Posting product, approved scope, user authorization, UX rules, and audit state | Publishing to accounts that did not consent |
| Research API | Support approved independent, non-profit research into eligible public data | Researcher, organization, project, region, and ethical-review eligibility | Commercial analytics, prospecting, or a general scraping feed |
| Webhooks | Notify an app about events supported by its connected products | Registered HTTPS callback, supported events, and signature verification | Access to a product or dataset the app was not approved to use |
| TikTok Shop API | Integrate approved seller, creator, partner, product, order, fulfillment, logistics, finance, or affiliate workflows | Separate Partner Center onboarding, scopes, reviews, role authorization, and request signing | TikTok for Developers' Display or Research products |
Display and Content Posting APIs
The official Display API overview lists endpoints for an authorized user's basic profile, recent videos, and selected video metadata. Typical scopes include user.info.basic and video.list. That authorization does not license an app to enumerate unrelated creators or assemble a shadow database.
The Content Posting API supports Direct Post and draft upload flows. Direct posting requires the app and user to hold the relevant posting permission; draft upload uses a separate permission and leaves final editing and posting with the user. Current guidance says content from an unaudited Direct Post client is restricted to private visibility. URL-based media transfer also requires verified domain or URL-prefix ownership.
Research API is a special-purpose program
TikTok's Research Tools are for qualifying independent or academic researchers conducting approved non-profit research. Applicants must meet organizational, regional, project, and ethical-review conditions. A normal commercial developer account is not enough, and the Research API should not be presented as a route for influencer prospecting or unrestricted scraping.
Plan authorization, scopes, and app review
For TikTok for Developers products, create an app, add only the products and scopes the use case needs, configure verified URLs and redirect URIs, and submit the production configuration for review. The current app review guidelines require a working public experience, privacy policy, terms, a detailed explanation of every product and scope, and a demo of the end-to-end integration. Review is not automatic or guaranteed.
Login Kit uses OAuth 2.0. Send the user through TikTok's consent flow, validate state, use PKCE where the documented client flow requires it, exchange the authorization code on the server, and store access and refresh tokens server-side. Users may approve only a subset of requested scopes. Design for partial consent, token expiry, refresh, deauthorization, account deletion, and permission changes rather than assuming permanent access.
- Define the user benefit: write down the exact action and data fields.
- Select one official product: do not infer access from another TikTok product.
- Request least privilege: ask only for scopes demonstrated in the product experience.
- Complete review: keep the production site, policies, redirect URIs, and demo aligned.
- Record consent: retain the authorization subject, scopes, timestamps, and current token state without logging secrets.
- Test revocation: remove access and derived data according to policy when authorization ends.
Design a maintainable integration architecture
Separate authorization, token storage, API calls, webhook intake, and business workflows. A practical system has an OAuth callback service, an encrypted token vault, a typed API client, a queue for retryable jobs, an idempotent webhook consumer, and an audit trail for consent and deletion. Keep client secrets, refresh tokens, and Shop app secrets out of browsers, mobile bundles, logs, analytics events, and support tickets.
Store the external identifiers and fields required for the approved purpose, not entire responses by default. Version your field mapping, because permissions and response schemas change. Treat missing fields, revoked scopes, stale metrics, and market-specific features as normal states. Build reconciliation jobs for important workflows rather than assuming one request or webhook proves final completion.
Handle rate limits, retries, and webhooks
TikTok documents limits at the product or endpoint level. Avoid copying a single request-per-minute value into a system-wide rule. Maintain endpoint-aware budgets, cap concurrency, cache only where policy permits, and respond to throttling with bounded exponential backoff and jitter. Do not retry permission errors or invalid requests as if they were transient. Monitor error codes, request IDs, latency, token refresh, queue age, and quota headroom.
The current webhook overview describes HTTPS POST delivery, immediate acknowledgment, retries, and at-least-once behavior. Verify the TikTok-Signature against the raw body and timestamp as documented, reject stale or invalid messages, deduplicate events, return success quickly, and process downstream work asynchronously. At-least-once delivery means duplicate events are expected.
Reliability rule: an accepted API request is not always the finished business action. Track asynchronous publish status, webhook outcome, and reconciliation state separately.
Protect data and user choice
Use data minimization, purpose limitation, encryption, role-based access, retention limits, and documented deletion. Your public privacy policy should match the real fields and processors in production. Provide a path for access and deletion requests, and stop scheduled jobs immediately when a user disconnects. Review regional obligations and TikTok's terms with qualified privacy and legal owners.
Do not collect TikTok data through browser automation merely because the approved API omits it. An absent field can express a product, consent, safety, or contractual boundary. If the use case changes, update the product design and seek the additional scope or review before expanding collection.
Separate TikTok Shop and Reacher responsibilities
The TikTok Shop developer guide lives in Partner Center and covers different onboarding, app types, scopes, role authorization, request signing, reviews, and data domains. Seller data requires seller authorization even for many public-scope APIs; sensitive custom scopes need additional approval. Creator and partner APIs use their own access boundaries. Do not reuse a Login Kit token or Research approval as proof of Shop access.
Reacher helps TikTok Shop teams organize creator discovery, outreach, CRM, sample operations, and affiliate performance workflows. Reacher is not a general TikTok developer proxy: it does not grant Display, Content Posting, Research, or Shop scopes; bypass user consent; promise access to private data; or provide unrestricted scraping or posting capabilities. Platform-native authorization and status remain the source of truth.
Frequently asked questions
Is there one TikTok API for every use case?
No. TikTok for Developers and TikTok Shop Partner Center provide separate products with different purposes, reviews, scopes, users, and terms.
Can the Display API search every TikTok creator?
No. Its documented purpose is to display eligible profile and video information for a user who authorized the app with approved scopes.
Can a commercial brand use the Research API?
Not as a general commercial analytics feed. Research Tools require an eligible researcher, organization, region, project, ethical review, application, and approval for non-profit research.
Can an app publish without creator consent?
No. Content Posting requires the relevant approved scope and authorization from the target user. Direct Post also has audit and UX requirements.
Are TikTok API rate limits fixed?
Limits vary by product and endpoint and can change. Read the live reference, monitor responses, and implement endpoint-aware throttling and bounded retry behavior.
Does Reacher provide access to TikTok APIs?
Reacher supports its documented TikTok Shop creator-operation workflows. It does not replace TikTok's developer products, app reviews, scopes, tokens, consent, or Shop Partner Center access.