TikTok
Connect TikTok to post videos and photo carousels, send drafts to your inbox, track how each post performs, and read your profile and follower stats.
You end up pasting the Client key and Client secret from the Credentials block of your app in the TikTok for Developers portal.
App review before this connector works
TikTok for Developers must review and approve your app - each product (Login Kit, Display API, Content Posting API) and each scope is granted individually - before the app leaves sandbox and real TikTok users can authorise it.
- Typical wait
- TikTok's own developer FAQ states "App review may take several days to two weeks after submission." There is no guarantee of approval, and a rejected app restarts the clock on resubmission.
- Cost
- No fee. TikTok charges nothing for a developer account, sandbox use, or app review.
- Blocked until approved
- Production OAuth for anyone outside your sandbox. An unapproved app works only for the TikTok accounts you explicitly add as sandbox target users - TikTok caps this at 10 accounts per sandbox - so no customer can connect their own account. Approval grants only the products and scopes named in the application (TikTok: "your app will have access to the products and scopes requested in the application"), so anything you did not request and demonstrate needs a fresh submission. The Content Posting API is a further step: until your client passes its audit, everything it posts is forced to private viewing mode.
- Works meanwhile
- Sign up at developers.tiktok.com, create an app and get a client key and client secret instantly, then build the entire integration in Sandbox mode - the full OAuth flow, Display API reads and Content Posting all work against your own and up to 10 invited TikTok accounts. You then import the sandbox configuration into the production draft to submit.
Where to apply: developers.tiktok.com > Manage apps > your app > add products and scopes, complete App details and App review information, then Submit for review. First-time apps must attach at least one demo video (max 5 videos, 50 MB each) recorded against the sandbox showing the complete end-to-end flow for every product and scope requested.
- Mobile apps are rejected unless they are already live on the App Store and/or Google Play - a TestFlight or internal build will not pass.
- Apps described as being for personal or private use, in development, or as a test are rejected; the reviewer wants a shipping product.
- The privacy policy and terms of service URLs must be live and reachable on the exact domain you registered, and web apps must complete URL ownership verification.
- Requesting more scopes than the demo video actually demonstrates is a common rejection - only ask for what you show.
- App names may not reference TikTok or other social platforms, and generic names or placeholder icons get bounced.
- The Content Posting API needs a separate audit for public posting; approval of the product alone still leaves your posts private.
- Setup time
- 25 min, plus 5-10 business days for app review
- Auth
- OAuth authorization
- API base URL
- https://open.tiktokapis.com/v2
- Rate limits
- Six requests per minute per user access token on the video and photo publishing endpoints, and 20 per minute for the creator info query. An undisclosed daily post cap per creator also applies, returning `spam_risk_too_many_posts`, and that cap is shared across every app the creator has authorised.
Before you begin
- A TikTok developer account created at developers.tiktok.com/signup
- An organization to own the app, strongly recommended for real integrations
- A public website you control, so you can verify URL ownership of your Terms of Service, Privacy Policy and web URLs
- A demo video of the end-to-end flow (up to 5 videos, 50 MB each) for the review submission
- App review approval before anyone outside Sandbox can connect. The Content Posting API also requires verified URL properties
Get your credentials
Connect an app
Click your profile icon in the main navigation bar and choose Manage apps. Click Connect an app, pick your organization under Select the app owner, and click Confirm.
Manage apps
Apps you own or have been granted access to.
| App name | App ID | Owner | Status | Created |
|---|---|---|---|---|
| PopMCP PublisherWeb | 70123456784821 | Acme Supply | Draft | Mar 4, 2026 |
| Acme ReportingWeb | 70118822440913 | Acme Supply | Live | Nov 19, 2025 |
A brand new developer account shows an empty list here.
Fill in App details and Platforms
Under App details open Basic information and set the App icon (1024 x 1024, up to 5 MB), App name, Category and Description. In Platforms select Web and enter your website URL along with the Terms of Service and Privacy Policy URLs.
Add Login Kit and the Content Posting API, then the scopes
In Products click Add products and add Login Kit and Content Posting API. Paste PopMCP's callback URL into Login Kit's Redirect URI, then open Scopes and add user.info.basic, user.info.profile, user.info.stats, video.list, video.upload and video.publish.
Products
Each product carries its own settings block and its own review questions.
| Product | Purpose | Status |
|---|---|---|
| Login KitOAuth and redirect URIs | Authorises the creator | Added |
| Content Posting APIDirect Post and inbox drafts | Publishes videos and photos | Added |
| Display APIRead public video data | Not required by PopMCP | Not added |
Redirect URIs must be https, static and free of query strings. Login Kit accepts up to 10.
Verify URL ownership
Click URL properties at the top of the app page, confirm you are in Production mode, and click Verify properties. Choose Domain or URL prefix, download the signature file, and upload it to that location.
Copy the Client key and Client secret
Open App details and find the Credentials block. Copy the Client key, click Show to reveal the Client secret, and paste both into PopMCP.
App details
Credentials, basic information and the platforms this app runs on.
- Client key
- aw8f****k2qd
- Client secret
- GTa9****x7Lp
- App ID
- 70123456784821
- Status
- Draft
The description on this screen is shown to creators on the authorization page.
Submit for review and go Live
Fill in the App review section, explaining how each product and scope is used, and upload at least one demo video of the full flow. Click Save, then Submit for review.
Connect in PopMCP
Open your workspace, choose TikTok in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Client keytext | Your TikTok app's "Client key" from developers.tiktok.com (Manage apps -> your app -> Basic information). Add the callback URL above as a Login Kit redirect URI on that app first. |
| Client secretsecret | The app's Client secret (same page as the Client key). Stored encrypted; used server-side only and never shown again.Encrypted with AES-256-GCM on save and never shown again. |
https://app.popmcp.com/api/providers/tiktok/callbackOnly needed if you connect with your own TikTok app: add this exact URL as a Login Kit redirect URI (developers.tiktok.com -> Manage apps -> your app -> Login Kit). TikTok requires https, no query string and no fragment, and it must match character for character.
PopMCP verifies the credential against TikTok immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to TikTok at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| user.info.basic | Baseline identity such as open ID, display name and avatar. Required by Login Kit. |
| user.info.profile | Reads profile fields such as bio, username and profile deep link. |
| user.info.stats | Reads follower, following, likes and video counts for the account stats tools. |
| video.list | Lists the user's published videos so PopMCP can report per-post performance. |
| video.upload | Sends a video to the creator's TikTok inbox as a draft for them to finish and post. |
| video.publish | Direct Post, which publishes straight to the profile. Reviewers scrutinise this scope most and it needs verified URL properties. |
Verify it worked
The TikTok connector opens the TikTok authorization screen. After you approve, the card shows your display name and avatar with a Connected badge, and the posting and analytics tools appear.
Troubleshooting
redirect_uri mismatch on the authorize screen
Why: The callback URL is not registered in the Login Kit product configuration, or it has a query string or fragment appended.
Fix: Add PopMCP's exact callback URL as a Redirect URI under Products, Login Kit. It must be absolute, static and under 512 characters.
HTTP 429 with error code rate_limit_exceeded
Why: More than six publish requests in a one-minute sliding window on the same user access token.
Fix: Space out posts. The limit is per user token, so adding more app credentials does not help.
Direct Post is rejected or the scope is unavailable
Why: video.publish was not approved in review, or the app's URL properties are unverified.
Fix: Verify URL properties, then resubmit App review with a demo video that shows the posting flow on the same domain you registered.
Only your own account can connect
Why: The app is still in Draft or is running in Sandbox mode.
Fix: Submit the Production revision for review and wait for the status to become Live. Review typically takes 5-10 business days.
Credentials stop working after an edit
Why: Clicking Create revision on a Live app produces a Draft that is not live until it is re-approved.
Fix: Resubmit the revision for review. The previous Live configuration keeps serving until then.