TikTok API in 2026: Access, Keys, Limits and Posting

TikTok for Developers lists its products on the products page. For most developers the choice comes down to the rows below. Ads are a separate world: campaign management lives on the TikTok API for Business portal at business-api.tiktok.com, with its own accounts and credentials.

Two consequences follow from that table. First, there is no general-purpose API for reading other people's TikTok videos in a commercial product: the Display API only returns data for users who logged in to your app, and the Research API is for vetted, non-commercial research. Second, if you want to post, you need Login Kit plus the Content Posting API, and the hard part is the audit, not the endpoint.

TikTok for Developers does not publish a price list for Login Kit, the Display API or the Content Posting API, and nothing in its app registration guide involves billing. What you spend is time. Every app goes through review before its integrations go live, posting apps go through a second audit before their posts can be public, and the Research and Commercial Content APIs only open after an application is approved.

That is a different model from X, which bills API usage, or LinkedIn, which puts Company Page posting behind a partner program (see LinkedIn API pricing and access tiers). The practical cost of the TikTok API is the review queue and the caps that apply while you wait, which the rest of this guide spells out.

TikTok does not issue a single "API key". Each app gets a client key and a client secret, shown in the Credentials section of the app page. Per TikTok's app registration guide, the path from zero to a live app looks like this:

1. Create a developer account, and ideally an organization so teammates share access to the app.
2. Connect an app and fill in the basics: icon (1024 x 1024 px), name, category, description and the platforms it runs on (Web, Desktop, iOS, Android).
3. Add products, such as Login Kit and Content Posting API, and set a redirect URI for Login Kit.
4. Add the scopes you need. user.info.basic comes with Login Kit; posting needs video.publish (Direct Post) or video.upload (drafts).
5. Verify URL ownership for your Terms of Service, Privacy Policy and website URLs, and for any domain TikTok will pull media from.
6. Submit for review with an explanation of how each product and scope is used and at least one demo video of the full flow (up to five videos, 50 MB each).

You don't have to wait for review to start building. The sandbox lets you create up to five test configurations and add up to ten TikTok accounts you own as target users. Sandbox mode does not cover public posting through the Content Posting API, so plan to test with private posts until the app is live and audited.

Treat the client secret like a password. TikTok's content sharing guidelines say it must never be shared with third parties or embedded in open-source projects, and every token call should run on your server, not in a browser or mobile client.

User-facing APIs use OAuth 2.0 through Login Kit. You send the user to TikTok's authorization page with your client key, the scopes and a redirect URI. TikTok sends a code back to that URI, and your server exchanges it for tokens:

# 1. Send the user to TikTok's consent page (Login Kit for Web)
https://www.tiktok.com/v2/auth/authorize/
  ?client_key=$CLIENT_KEY
  &response_type=code
  &scope=user.info.basic,video.publish
  &redirect_uri=https://yourapp.com/callback
  &state=$RANDOM_STATE

# 2. Your callback receives ?code=... and your server exchanges it
curl -X POST https://open.tiktokapis.com/v2/oauth/token/ \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_key=$CLIENT_KEY" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "code=$CODE" \
  -d "grant_type=authorization_code" \
  -d "redirect_uri=https://yourapp.com/callback"
# -> access_token (expires_in), refresh_token (refresh_expires_in), open_id, scope

The token lifetimes are where older tutorials go wrong. TikTok's token management page, last updated on November 2, 2026, lists an access token lifetime of 2 hours and a refresh token lifetime of 180 days. Earlier versions of the same page said 24 hours and 365 days, which is what most tutorials still repeat, so code with those numbers hardcoded will try to use expired tokens. Refreshing returns a new refresh token every time, and if you keep using the old one, later refreshes fail and the user has to authorize your app again. So store access_token, refresh_token, open_id, scope and both expiry times per user, schedule refreshes from expires_in instead of hardcoding a number, and write the rotated refresh token back in the same transaction.

Mobile and desktop apps add a PKCE code_verifier to the exchange. The Research and Commercial Content APIs work differently: they use a client access token tied to your approved project, with no user in the loop.

The Content Posting API has two modes. Direct Post (video.publish) publishes straight to the creator's profile. Upload (video.upload) sends the video or photos to the creator's TikTok inbox, and they finish editing and posting in the app. A Direct Post takes three calls, per the Direct Post quick start:

# 1. Ask TikTok what this creator is allowed to post
curl -X POST https://open.tiktokapis.com/v2/post/publish/creator_info/query/ \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json; charset=UTF-8"
# -> privacy_level_options, comment/duet/stitch flags, max_video_post_duration_sec

# 2. Start a Direct Post, letting TikTok pull the file from your verified domain
curl -X POST https://open.tiktokapis.com/v2/post/publish/video/init/ \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json; charset=UTF-8" \
  -d '{
    "post_info": {
      "title": "Launch day #buildinpublic",
      "privacy_level": "PUBLIC_TO_EVERYONE",
      "disable_comment": false,
      "disable_duet": false,
      "disable_stitch": false
    },
    "source_info": {
      "source": "PULL_FROM_URL",
      "video_url": "https://media.yourapp.com/videos/launch.mp4"
    }
  }'
# -> { "data": { "publish_id": "v_pub_url~v2..." } }

# 3. Poll until TikTok finishes processing
curl -X POST https://open.tiktokapis.com/v2/post/publish/status/fetch/ \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json; charset=UTF-8" \
  -d '{"publish_id": "v_pub_url~v2..."}'

The creator info call is not optional ceremony. Its response tells you which privacy levels this creator can pick, whether comments, Duets or Stitches are disabled in their settings, and the maximum video length, and TikTok expects your interface to reflect all of it.

For the media itself you choose a source. PULL_FROM_URL lets TikTok download the file, but only from a domain or URL prefix you verified in the app settings, and the URL has to stay reachable for up to an hour. FILE_UPLOAD returns an upload_url that you send the bytes to with PUT. The media transfer guide sets the chunk rules: each chunk between 5 MB and 64 MB, the last one up to 128 MB, at most 1,000 chunks, uploaded in order, and files under 5 MB sent whole. TikTok's own guidelines tell you to use PULL_FROM_URL whenever the file already sits on your servers.

Photo posts use a different endpoint, /v2/post/publish/content/init/, with media_type: PHOTO and a list of image URLs. Either way, the init call returns a publish_id and processing happens asynchronously, so a 200 on init only means TikTok accepted the job. Poll /v2/post/publish/status/fetch/ or subscribe to webhooks before you tell anyone the post is live.

TikTok's limits come in two kinds: request rate limits per endpoint, and posting caps per app and per creator. The posting caps are the ones that break products.

Sources: TikTok's rate limits page, the content sharing guidelines and the Direct Post and Upload API references. The per-creator ceiling is shared with every other tool the creator uses, so a creator who already posted through two schedulers today may hit it on your first request. Our social media API rate limits reference puts these numbers next to the other networks. If you are deciding whether to apply for the audit now or later, TikTok audited vs. unaudited clients walks through what changes and what stays the same.

Most audit rejections come from the interface, not the API calls. The content sharing guidelines describe the screen your users must see before a Direct Post. Use this as a checklist before you submit:

• Show the creator's nickname so they know which account receives the post.
• Let the user pick the privacy level from a dropdown built from privacy_level_options, with no default value.
• Show Allow Comment, Duet and Stitch toggles, all off by default, and grey out any the creator disabled in TikTok. Photo posts only get Allow Comment.
• Add a commercial content disclosure toggle, off by default, with "Your brand" and "Branded content" options and the labels TikTok specifies. Branded content cannot be private.
• Show the consent line before the publish button: "By posting, you agree to TikTok's Music Usage Confirmation", plus the Branded Content Policy when that option is checked.
• Show a preview, let the user edit any preset caption or hashtags, and never add your watermark or logo.
• Only send media to TikTok after the user confirms, and tell them it can take a few minutes to appear on their profile.

The guidelines also rule out some products entirely. An app that copies arbitrary content from other platforms to TikTok is not acceptable, and neither is an internal tool that uploads to your own company accounts. TikTok wants apps that help real creators post original content, for a wide audience.

If TikTok is the core of your product and you have time for review, building directly makes sense: the API is well documented and free to call. The cost shows up elsewhere. You maintain two-hour access tokens with rotating refresh tokens for every creator, a chunked upload path, a polling or webhook loop for publish status, the compliance interface above, and an app that sits in private-only mode until the audit passes.

If TikTok is one destination among several, that is the work PostGate's TikTok integration takes on. Creators connect through a hosted OAuth page using PostGate's already-audited TikTok app. You send one request to publish a video or a 1 to 35 image photo post, in Direct Post or inbox mode, and read the delivery status per destination. The creator info and disclosure fields are still required, because TikTok requires them, and the per-creator daily ceiling still applies.