> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pendpost.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TikTok

> Set up TikTok video posting with Login Kit and the Content Posting API.

The TikTok lane uploads videos through the Content Posting API. It publishes only once a TikTok credential is present in your `.env`; until then the lane is live-but-unauthenticated and waits for you to connect it (set `PENDPOST_MODE=mock` to exercise it through the mock driver).

> [!NOTE]
>
> **Beta lane.** TikTok is built but not yet live-verified end to end, so treat it as a preview and do not rely on it for guaranteed delivery. The lane loses this badge once it is live-verified.

You own your TikTok account and are responsible for TikTok's terms of service. pendpost drafts and schedules, but a human approves before anything goes live.

> [!NOTE]
>
> **Unaudited apps post privately.** Until your app passes TikTok's content-posting audit, every post is forced to `SELF_ONLY`, visible only to the posting account. Submit the app for audit to publish publicly.

## Setup ceremony

The app uses the `user.info.basic`, `video.upload`, and `video.publish` scopes. The auth command runs a local loopback server to receive the authorization code.

1. **Create a developer app.** Open the [TikTok developer portal](https://developers.tiktok.com/apps/) and create an app. Add the Login Kit and Content Posting API products. Copy the client key and client secret from the app credentials.
2. **Record the client secret.** Copy the client secret and store it. It is used on the token exchange and refresh calls.
3. **Add the redirect uri.** In the app settings, register the redirect uri exactly: `http://127.0.0.1:8088/oauth/tiktok/callback`. The auth command runs a local loopback server there.

Then authorize. It opens the consent screen, exchanges the code, and stores the access and refresh tokens with their expiry:

```bash theme={null}
node scripts/tiktok-social.mjs auth
```

The access token is refreshed automatically before it expires.

## Environment variables

| Variable | Purpose |
| - | - |
| `TIKTOK_CLIENT_KEY` | Your TikTok app's client key. |
| `TIKTOK_CLIENT_SECRET` | Your TikTok app's client secret. |
| `TIKTOK_REDIRECT_URI` | The OAuth redirect uri, `http://127.0.0.1:8088/oauth/tiktok/callback`. |
| `TIKTOK_ACCESS_TOKEN` | Access token from the auth ceremony (refreshed automatically). |
| `TIKTOK_REFRESH_TOKEN` | Refresh token from the auth ceremony. |
| `TIKTOK_TOKEN_EXPIRES_AT` | When the access token expires. |

> [!NOTE]
>
> A lane publishes only once its credential is present. If the TikTok variables are blank, the TikTok lane is live-but-unauthenticated and waits for you to connect it. Set `PENDPOST_MODE=mock` to exercise it through the mock driver.

## Validate the lane

A present credential is not the same as a working one. After setup, validate the TikTok lane in the **Setup** tab, or run a live probe with the `health_recheck` tool, to confirm the credential is live and not just configured. The lane is ready when it reports live.

> [!NOTE]
>
> **Over MCP.** Setup and rotation are an interactive human ceremony; secrets are never written through MCP. An agent can still check status (`account_status`), run a live liveness probe (`health_recheck`), and read non-secret config (`config_get`) over MCP without touching credentials.

## Common failures

| Symptom | Cause | Fix |
| - | - | - |
| The consent screen rejects the redirect uri. | The redirect uri in the app settings does not match the loopback address used by the auth command. | Register `http://127.0.0.1:8088/oauth/tiktok/callback` in the app and set `TIKTOK_REDIRECT_URI` to the same value. |
| A scope error during authorization. | The app does not have the Content Posting API or the requested scopes approved. | Add the Content Posting API product and request the `video.upload` and `video.publish` scopes for the app. |
| Posts publish but are not publicly visible. | The app has not passed content-posting audit, so posts are forced to `SELF_ONLY`. | Submit the app for TikTok audit; until then expect `SELF_ONLY` visibility. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.