TikTok Login Kit: OAuth oqimi va token hayotiy sikli

TikTok OAuth qanday ishlaydi?

Asosiy atamalar: client key, client secret, open_id va tokenlar

client_key

Ilovaning ochiq identifikatori. Avtorizatsiya havolasida va token so'rovlarida yuboriladi.

client_secret

Ilovaning maxfiy kaliti. Faqat serverdan /v2/oauth/token/ va /v2/oauth/revoke/ so'rovlarida ishlatiladi; brauzer yoki mobil ilova kodiga qo'yilmaydi.

code

Foydalanuvchi rozilik bergach redirect URI'ga qaytadigan avtorizatsiya kodi. Uni darhol tokenga almashtiring.

access_token

API so'rovlari uchun Bearer token, berilgan paytdan 24 soat amal qiladi.

refresh_token

Yangi access token olish uchun; birinchi berilganidan 365 kun amal qiladi. Yangilash javobida boshqa refresh token kelishi mumkin.

open_id

Token bilan qaytadigan TikTok foydalanuvchisining noyob identifikatori. Ulangan akkaunt kaliti sifatida ishlating.

state

Yo'naltirishdan oldin yaratiladigan va callback'da solishtiriladigan tasodifiy qiymat — CSRF'dan himoya.

Veb ilova uchun TikTok OAuth'ni qanday sozlash kerak

1. 1

   Redirect URI'larni ro'yxatdan o'tkazing

   Login Kit sozlamalarida 10 tagacha redirect URI qo'shing. Har biri to'liq (absolute), https bilan boshlanadigan, 512 belgidan qisqa, statik (query parametrsiz) va # fragmentsiz bo'lishi kerak.

2. 2

   State yarating va saqlang

   Har bir kirish urinishi uchun tasodifiy satr yarating va uni foydalanuvchi sessiyasida yoki qisqa muddatli cookie'da saqlang. TikTok'ning o'z veb namunasi ham qisqa muddatli cookie ishlatadi.

3. 3

   Avtorizatsiya sahifasiga yo'naltiring

   https://www.tiktok.com/v2/auth/authorize/ ni client_key, response_type=code, vergul bilan ajratilgan scope, redirect_uri va state bilan oching. Rozilik oynasini har doim ko'rsatish uchun disable_auto_auth=1 qo'shing.

4. 4

   Callback'ni tekshiring

   TikTok code, scopes va state ni, xato bo'lsa error va error_description ni qaytaradi. state mos kelmasa so'rovni rad eting va berilgan scopes ni so'raganingiz bilan solishtiring.

5. 5

   Kodni serverda almashtiring

   https://open.tiktokapis.com/v2/oauth/token/ ga application/x-www-form-urlencoded ko'rinishida client_key, client_secret, code, grant_type=authorization_code va o'sha redirect_uri ni POST qiling. Desktop va mobil ilovalar code_verifier ham yuboradi.

6. 6

   Tokenlarni xavfsiz saqlang

   access_token, refresh_token, ikkala muddat va open_id ni shifrlangan holda saqlang. TikTok veb qo'llanmasi client secret va refresh token xavfsizligini aniq server zimmasiga yuklaydi.

Python'da Login Kit

Frameworkka bog'liq bo'lmagan handler'lar: session — web frameworkingiz beradigan sessiya ombori.

import secrets
from socialift import TikTok

REDIRECT_URI = "https://app.example.com/oauth/tiktok/callback"
SCOPES = ["user.info.basic", "video.list", "video.publish"]

async def begin_login(session: dict) -> str:
    session["tiktok_state"] = secrets.token_urlsafe(32)
    async with TikTok.from_env() as tt:
        return tt.login_url(
            redirect_uri=REDIRECT_URI,
            state=session["tiktok_state"],
            scopes=SCOPES,
        )

async def finish_login(session: dict, code: str, state: str) -> dict:
    expected = session.pop("tiktok_state", "")
    if not expected or not secrets.compare_digest(state, expected):
        raise ValueError("OAuth state mismatch")
    async with TikTok.from_env() as tt:
        bundle = await tt.exchange_code(code, redirect_uri=REDIRECT_URI)
    return {
        "open_id": bundle.raw.get("open_id"),
        "access_token": bundle.access_token,
        "refresh_token": bundle.refresh_token,
        "expires_at": bundle.expires_at,
        "scopes": bundle.scopes,
    }

PKCE: veb, desktop va mobil

TikTok desktop qo'llanmasi code_challenge ni verifier'ning SHA-256 xeshidan hex ko'rinishida hisoblaydi — RFC 7636'dagi base64url emas.

Desktop ilovalar uchun PKCE

Verifier 43–128 belgidan iborat bo'lishi va faqat A–Z, a–z, 0–9 hamda -, ., _, ~ belgilaridan tuzilishi kerak.

import hashlib
import secrets
from socialift import TikTok

REDIRECT_URI = "http://127.0.0.1:3455/callback/"

def make_pkce() -> tuple[str, str]:
    verifier = secrets.token_urlsafe(48)                       # 64 belgi
    challenge = hashlib.sha256(verifier.encode()).hexdigest()  # hex, TikTok hujjatidagidek
    return verifier, challenge

async def desktop_login(state: str) -> tuple[str, str]:
    verifier, challenge = make_pkce()
    async with TikTok.from_env() as tt:
        url = tt.login_url(
            redirect_uri=REDIRECT_URI,
            state=state,
            code_challenge=challenge,
            code_challenge_method="S256",
        )
    return url, verifier

async def desktop_callback(code: str, verifier: str):
    async with TikTok.from_env() as tt:
        return await tt.exchange_code(code, redirect_uri=REDIRECT_URI, code_verifier=verifier)

Token muddatlari va ular bilan nima qilish kerak

boryo'q

Kunlik yangilash va uzishda bekor qilish

from datetime import datetime, timedelta, timezone
from socialift import ApiError, TikTok

async def ensure_fresh(account: dict) -> dict:
    left = account["expires_at"] - datetime.now(timezone.utc)
    if left > timedelta(hours=2):
        return account
    async with TikTok.from_env() as tt:
        try:
            bundle = await tt.refresh_token(account["refresh_token"])
        except ApiError:
            account["status"] = "reconnect_required"
            return account
    account.update(
        access_token=bundle.access_token,
        refresh_token=bundle.refresh_token or account["refresh_token"],
        expires_at=bundle.expires_at,
    )
    return account

async def disconnect(account: dict) -> None:
    async with TikTok.from_env() as tt:
        await tt.revoke(account["access_token"])

Amalda scope'lar va rozilik

TikTok OAuth xavfsizlik tekshiruv ro'yxati

• ▸Client secret va refresh token'lar faqat serverda, shifrlangan holda saqlansin.
• ▸Har bir kirish uchun yangi state yarating va mos kelmagan callback'larni rad eting.
• ▸Aniq, statik HTTPS redirect URI ro'yxatdan o'tkazing; kontekstni query parametrda emas, state yoki sessiyada tashing.
• ▸Desktop ilovalarda S256 bilan PKCE ishlating va almashtirishda code_verifier yuboring.
• ▸Access token'ni 24 soatdan qisqa jadval bilan yangilang va almashgan refresh token'larni saqlang.
• ▸Foydalanuvchi mahsulotingizda uzganda tokenni /v2/oauth/revoke/ bilan bekor qiling.
• ▸Muvaffaqiyatsiz so'rovlardagi log_id ni TikTok qo'llab-quvvatlashi uchun logga yozing.