TikTok posting API

No. TikTok posting isn't available on our API yet: it needs TikTok's audit, which our app hasn't been through, and video posting isn't built on any network in our API yet. It goes live here only after approval and a public post going through end to end.

X, Bluesky, LinkedIn, Mastodon and Telegram are live today; the social media API page has the details, and pricing shows how accounts are billed once a network is live. The rest of this page is about TikTok's own API, so you can judge whether to build on it directly.

Register an app on TikTok for Developers, add the Content Posting API product, enable the Direct Post configuration, and get the video.publish scope approved. Each creator then authorizes your app for that scope, which gives you their user access token and open id.

Before every post, TikTok requires a Query Creator Info call. It returns details such as the privacy levels the creator can use and their maximum video duration (the example in TikTok's docs shows 300 seconds), and your upload screen must use those values.

Unaudited apps can call the API, but TikTok restricts all their content to private viewing. Its sharing guidelines add that an unaudited client can let at most 5 users post in a 24-hour window, those accounts must be private, and posts must use SELF_ONLY visibility. Posting otherwise returns unaudited_client_can_only_post_to_private_accounts.

That's why an unaudited app is fine for testing and useless for publishing for anyone else. Meta's equivalent gate for Instagram is App Review, covered in our Instagram API guide. To lift it, the client must pass TikTok's audit, and TikTok's content sharing guidelines describe the posting experience it expects:

• Show the creator's nickname on the upload screen.
• Offer the privacy levels from Query Creator Info with no default selected.
• Leave Comment, Duet and Stitch toggles off by default, and grey out ones the creator has disabled.
• Include a commercial content disclosure, off by default, with Your brand and Branded content options; branded content can't be private.
• Show a preview, let the user edit preset titles and hashtags, and only upload after they consent.
• Don't add promotional watermarks or logos to creators' content.

Call POST https://open.tiktokapis.com/v2/post/publish/video/init/ with a post_info object (caption, privacy_level and interaction settings) and a source_info object. With FILE_UPLOAD you declare the size and chunking and get back an upload_url, which expires after one hour; with PULL_FROM_URL TikTok fetches the file itself.

The response carries a publish_id. Processing is asynchronous, so poll the post status endpoint or use webhooks, and tell the user it may take a few minutes to appear on their profile. If an AI agent drives the upload, the consent and preview rules above still apply; our MCP server doesn't offer TikTok yet.

curl -X POST https://open.tiktokapis.com/v2/post/publish/video/init/ \
  -H "Authorization: Bearer $TIKTOK_USER_TOKEN" \
  -H "Content-Type: application/json; charset=UTF-8" \
  -d '{
    "post_info": {
      "title": "Shipping day #buildinpublic",
      "privacy_level": "SELF_ONLY",
      "disable_comment": false,
      "disable_duet": false,
      "disable_stitch": false
    },
    "source_info": {
      "source": "PULL_FROM_URL",
      "video_url": "https://media.example.com/launch.mp4"
    }
  }'

# 200 → { "data": { "publish_id": "..." }, "error": { "code": "ok" } }

TikTok only pulls media from URLs it knows you own. Verify a domain by adding a signature string to its DNS records, and every path under it and its subdomains counts as yours; or verify a URL prefix. Pulling from an unverified URL returns url_ownership_unverified.

The URL must be HTTPS, its host must be a domain rather than an IP address, and it must not redirect. Photo posts only accept PULL_FROM_URL, so photo posting needs this set up from day one.

Each user access token can make 6 requests per minute to the posting endpoints; going over returns 429 rate_limit_exceeded. Each creator also has a daily post cap that varies by creator and is typically around 15 posts a day, per TikTok's sharing guidelines, returned as spam_risk_too_many_posts.

On top of that, each API client has a 24-hour cap on how many creators can actively post through it (reached_active_user_cap), and inbox uploads allow at most 5 pending shares per 24 hours (spam_risk_too_many_pending_share).

The Direct Post reference lists these. Most of them mean show the user a message, not retry:

• 401 access_token_invalid or scope_not_authorized: refresh the token or ask the creator to grant video.publish.
• 403 privacy_level_option_mismatch: the privacy level isn't one Query Creator Info returned.
• 403 spam_risk_user_banned_from_posting: the creator can't post right now; nothing to retry.
• 400 invalid_param: read the error message for the field at fault, such as chunk sizes that don't match video_size.
• 5xx: TikTok server or network error; retry later.