TikTok API integration
Socialift brings the TikTok API into the same Python SDK as Instagram, Facebook and LinkedIn: Login Kit OAuth with 24-hour access tokens and 365-day refresh tokens, creator profile and videos, video and photo-carousel publishing through the Content Posting API, Business Account API insights and comments, and webhook signature checks.
Updated:
What can you do with the TikTok API?
The TikTok API is the set of official interfaces offered by TikTok for Developers. Once a user grants access through Login Kit, your app can read their profile and videos, publish videos or photo carousels with the Content Posting API, and work with video insights and comments through the Business Account API.
TikTok has quirks that make integrations harder: the access token lives only 24 hours, and a refresh can return a new refresh token that must replace the stored one. Open API v2 wraps every response in an error object (code: "ok" on success), while the Business API uses its own code/message envelope — so check the body, not just the HTTP status.
Socialift handles the mechanics: refresh_token() returns a TokenBundle with the new access and refresh tokens (your app stores them — the SDK keeps nothing); for accounts connected in the dashboard, the server's refresh endpoint (POST /tiktok/auth/refresh, also in the Playground) saves the new tokens encrypted; and TikTok error codes are raised as AuthError, PermissionError, RateLimitError or ApiError, as on every other platform.
What is supported on the TikTok side
Login Kit OAuth
Authorisation, code-to-token exchange, refresh and revoke. TokenBundle carries expires_at and refresh_expires_at for the 24-hour access token and 365-day refresh token.
Profile and videos
Creator profile, the video list page by page or collected in one go, and video details by specific IDs.
Video publishing
Content Posting API: publish from a URL or upload the file directly in chunks, then track the publish status.
Photo carousels and drafts
Publish a multi-image post, or send content to the creator's drafts inside TikTok.
Business Account API
Video and account insights; list, reply to, hide, delete, like and pin comments.
Webhooks
verify_tiktok_request checks the TikTok-Signature header (HMAC-SHA256 over timestamp and body) with a replay window; in the dashboard events are deduplicated and an authorization.removed event deactivates the account.
Publishing a video — starting with creator_info
TikTok requires creator_info before every post, and the user must pick the privacy level from that list themselves — no default value.
import asyncio
from socialift import TikTok
async def main(token: str, privacy_level: str):
async with TikTok.from_env() as tt: # TIKTOK_CLIENT_KEY / TIKTOK_CLIENT_SECRET
info = await tt.creator_info(token)
# privacy_level: the value the user picked from info["privacy_level_options"]
if privacy_level not in info["privacy_level_options"]:
raise ValueError("privacy level not allowed for this creator")
result = await tt.publish_video(token, video_url="https://cdn.example.com/reel.mp4",
title="New collection", privacy_level=privacy_level, wait=True)
print(result["publish_id"])
# Domain not verified? Upload the file itself in chunks
await tt.publish_video(token, video="reel.mp4", privacy_level=privacy_level)
asyncio.run(main("ACCESS_TOKEN", privacy_level="SELF_ONLY")) # the value chosen in your post formWith video_url TikTok downloads the file itself, so the media domain must be verified in the TikTok developer dashboard. With video= the file is uploaded in chunks and no domain verification is needed.
wait=True waits until TikTok has finished processing (up to ~2 minutes; raises ApiError on FAILED or timeout). If you do not wait, check the status later with await tt.publish_status(publish_id, token). Photo carousels use await tt.publish_photos(token, photo_urls=[...], title="...", privacy_level=privacy_level).
During the trial month (the first 30 days) the token unlocks every SDK feature, including publishing (creator_info, publish_video, publish_photos, upload_video) and insights (business_videos, business_account). After renewal, features depend on the token's plan — “Tekshirish va muhitlar” (Check and environments) in the dashboard shows the exact list. The dashboard Playground works regardless of plan.
Profile, videos and comments
Profile and videos work with the Login Kit token; insights and comments go through the Business API and need Business API access granted by TikTok.
import asyncio
from socialift import TikTok
async def main(token: str, video_id: str, comment_id: str):
async with TikTok.from_env() as tt:
profile = await tt.me(token)
page = await tt.videos(token, limit=20)
everything = await tt.iter_videos(token, max_items=100)
# Business API: business_id = the creator's open_id
biz = profile.id
stats = await tt.business_videos(token, business_id=biz, max_count=20)
account = await tt.business_account(token, business_id=biz)
comments = await tt.comments(video_id, token, business_id=biz)
await tt.reply_comment(comment_id, token, "Thank you!", video_id=video_id, business_id=biz)
asyncio.run(main("ACCESS_TOKEN", "VIDEO_ID", "COMMENT_ID"))A Business endpoint without a dedicated SDK method can still be called: await tt.business("business/get/", token, method="GET", params={...}). Errors and retries behave exactly as in every other method.
What each capability requires
The TikTok API is made up of several products, each with its own conditions. Use this table to plan the integration up front.
| Capability | SDK method | Condition on TikTok's side |
|---|---|---|
| Profile and videos | me · videos · iter_videos · video | OAuth through Login Kit |
| Video publishing — from a URL | publish_video(video_url=…) | Media domain verified in the TikTok dashboard |
| Video publishing — file upload | publish_video(video=…) | No domain verification needed |
| Photo carousel | publish_photos | URL only (PULL_FROM_URL), up to 35 images, verified domain or URL prefix |
| Public post | privacy_level | Audited app; otherwise SELF_ONLY, private account, ≤5 users per 24 h |
| Insights and comments | business_videos · business_account · comments | TikTok Business account and Business API access granted by TikTok |
| Webhooks | verify_tiktok_request | TikTok-Signature header |
These conditions are set by TikTok — no SDK can work around them.
Connecting TikTok in four steps
Create a TikTok app
In TikTok for Developers create an app, add Login Kit and the products you need, and copy the client key and client secret.
Add the keys to Socialift
Enter the client key and secret on the “Kalitlar” (Keys) page: they are stored encrypted and can be checked against TikTok in one click. After saving, the page shows the redirect URI and webhook URL.
Set the redirect URI and webhook
Paste that redirect URI into Login Kit and the webhook URL into the TikTok console. If you publish from URLs, verify the media domain or URL prefix.
Connect an account and test
On the “Ulanishlar” (Connections) page connect a TikTok account via OAuth, send your first request in the Playground and move the generated code into the SDK.
Before you ship to production
- A refresh may return a different refresh token — always store the value from the latest response.
- The access token lives 24 hours: account for refreshes in long-running background jobs.
- Call creator_info before every post and let the user pick privacy_level only from the list it returns.
- An app that has not passed the audit can only post with SELF_ONLY privacy, from private accounts, and for at most 5 users per 24 hours — that is TikTok's rule.
- For URL-based publishing, verify the domain in advance or upload the file directly.
- Don't rely on the HTTP status alone: Open API v2 responses carry a string
error.code(okon success) and alog_idthat TikTok support asks for.
Frequently asked questions
Can I upload videos to TikTok through the API?
Yes. The Content Posting API publishes a video from a URL or from a file uploaded directly in chunks. A creator_info request is mandatory before publishing, and the URL method requires a domain verified in the TikTok dashboard.
Why is my post visible only to me (SELF_ONLY)?
Until your app passes TikTok's audit, API posts can only use SELF_ONLY, the posting account must be private, and at most 5 users can post through the app in 24 hours. After the audit, use the levels creator_info returns; TikTok still caps posts per creator per day (typically around 15).
Can I read and reply to TikTok comments through the API?
Yes, through TikTok's Business (Accounts) API: list comments, reply, hide, delete, like and pin. You need a TikTok Business account and Business API access granted by TikTok.
How long does a TikTok token last?
The access token lasts 24 hours and the refresh token 365 days. A refresh may return a different refresh token, so always keep the latest one. With the SDK you store the TokenBundle yourself; for accounts connected in the dashboard, the server's refresh endpoint saves the new tokens encrypted.
Can I post TikTok stories through the API?
No. The Content Posting API covers video and photo posts only: the official Direct Post reference has neither a story endpoint nor a post_mode value for stories. This is not a Socialift limitation — it is the boundary of TikTok's own API, and stories can only be posted from the TikTok app. Anything you send through the API therefore lands as a regular post with the privacy_level returned by creator_info.
Is Socialift an official TikTok partner?
No. Socialift is an independent integration layer built on TikTok's public APIs. It does not hold official TikTok partner status.
Sources
Related pages
Add TikTok too
Get a token, add your TikTok app keys and send your first request from the Playground.
Get a free token →