Setting up a TikTok developer app

What does a TikTok app give you?

How to create and configure a TikTok for Developers app

1. 1

   Sign up and create the app

   Sign in to TikTok for Developers and create an app. TikTok recommends registering it under an organization; an individual developer account isn't recommended for real integrations.

2. 2

   Fill in the app details

   Icon (1024×1024 px, JPEG/JPG/PNG, up to 5 MB), name, category, description (shown on the authorization page), Terms of Service URL and Privacy Policy URL — these URLs are verified for apps created after September 9, 2024. The Web platform needs your official website URL.

3. 3

   Add Login Kit and the redirect URI

   Products → Add products → Login Kit. Redirect URI rules: an absolute https address, static, no query parameters and no #; at most 10 URIs, each under 512 characters; the redirect_uri in the request must match a registered one exactly.

4. 4

   Add Content Posting API and enable Direct Post

   Add the Content Posting API product and enable the Direct Post configuration in its settings. Direct posting requires your app to be approved for the video.publish scope and the user to grant it.

5. 5

   Add scopes

   In the Scopes section add only the scopes your integration actually uses (table below). Copy the Client key and Client secret from the Credentials section.

6. 6

   Verify URL ownership for PULL_FROM_URL

   In the URL properties widget add and verify a Domain (for example cdn.example.com — all paths under it) or a URL prefix (https:// + host + path + /). The media URL must use https, must not redirect and must stay reachable during the download (up to one hour after the task starts). Otherwise the API returns url_ownership_unverified (403). Uploading the file yourself (FILE_UPLOAD) needs no verification.

7. 7

   Configure the webhook callback URL

   Set the callback URL in the app settings (HTTPS only). The endpoint must respond with 200 immediately; otherwise TikTok treats the delivery as failed and retries for up to 72 hours with exponential backoff. Delivery is at least once — deduplicate events.

8. 8

   Test in sandbox

   Sandbox is a restricted environment for trying integrations without submitting for review. Run the full login and posting flow there with test accounts — that's also where you record the demo video.

9. 9

   Submit for review with a demo video

   Explain in detail how each product and scope is used in your app. Provide at least one demo video (up to 5, each up to 50 MB) showing the complete end-to-end flow, UI and user interactions; for web apps the domain in the video must match the website URL. The website must be fully developed, with Terms of Service and Privacy Policy links visible without opening a menu. Lifting the private-viewing restriction for Direct Post is a separate Content Posting API audit.

How to connect the TikTok app to Socialift

1. 1

   “Kalitlar” (Keys) → “TikTok app”

   In the dashboard open “Kalitlar” and the “TikTok app” card. Copy the Redirect URI from the “Konsolga ko'chiring” (Copy to console) block into the Login Kit settings character for character — even a trailing / matters.

2. 2

   Enter the Client key and Client secret

   “Scope'lar” (Scopes) is optional: when empty, user.info.basic, user.info.profile, user.info.stats, video.list, video.upload, video.publish are requested. “Saqlash va tekshirish” (Save and verify) makes Socialift request a client access token from TikTok's token endpoint to check the key.

3. 3

   Copy the Webhook URL

   After saving, the card shows a Webhook URL — paste it into TikTok's callback URL field. Events are verified by signature with your Client secret. The card also shows a “Webhook verify token” row, but TikTok has no such field — you can ignore it.

4. 4

   Connect the account

   In “Ulanishlar” (Connections) click “Ulash” (Connect) on the TikTok card. The access token lives 24 hours — “Token'ni yangilash” (Refresh token) renews it with the refresh token. Try the posting methods in Playground with SELF_ONLY.

Which scopes do you need and why?

Call creator_info before posting: privacy_level must be one of the returned privacy_level_options, otherwise you get privacy_level_option_mismatch.

TikTok keys in the Python SDK

TikTok.from_env() reads TIKTOK_CLIENT_KEY and TIKTOK_CLIENT_SECRET.

import asyncio
import secrets

from socialift import TikTok

REDIRECT_URI = "https://example.com/auth/tiktok/callback"  # identical to the Login Kit entry


async def main() -> None:
    # TIKTOK_CLIENT_KEY, TIKTOK_CLIENT_SECRET, SOCIALIFT_LICENSE_KEY
    async with TikTok.from_env() as tt:
        print(tt.login_url(redirect_uri=REDIRECT_URI, state=secrets.token_urlsafe(32)))

        bundle = await tt.exchange_code(input("code: "), redirect_uri=REDIRECT_URI)
        info = await tt.creator_info(bundle.access_token)  # required before posting
        print(info["privacy_level_options"])
        result = await tt.publish_video(bundle.access_token, video_url="https://cdn.example.com/reel.mp4",
                                        title="Hello TikTok!", privacy_level="SELF_ONLY", wait=True)
        print(result)


asyncio.run(main())

Common mistakes

• ▸The redirect URI differs from the Login Kit entry: http, a trailing / or a query parameter.
• ▸Posting publicly before the audit — content is limited to private viewing, and a public account gets unaudited_client_can_only_post_to_private_accounts.
• ▸creator_info isn't called, or privacy_level isn't in the returned list.
• ▸PULL_FROM_URL from an unverified domain or a redirecting URL — url_ownership_unverified.
• ▸The old refresh token is kept after a refresh — the next attempt is rejected.
• ▸JSON sent to the token endpoint — it needs application/x-www-form-urlencoded.
• ▸The domain in the demo video doesn't match the website URL, or a selected product isn't shown.
• ▸The webhook endpoint does heavy work and returns 200 late — TikTok retries and duplicates appear.