TikTok API Audit Requirements
What TikTok actually requires to pass API audit, and what changes once your app does.
By André LugTikTok’s audit reviews your app the way a real creator uses it — the OAuth consent screen, requested scopes, publish UI, and privacy-level handling — checking that behavior matches your stated use of the video.publish scope. Passing unlocks public posting and replaces the 5-users-per-24-hours cap; it does not raise the per-creator daily posting ceiling.
Every TikTok developer app starts unaudited, and TikTok enforces real restrictions on that state — forced private posting and a hard cap on distinct users — until your app passes review. Here is what that audit actually checks, what it does not change, and the shortcut PostGate offers if you would rather not run your own app through it at all.
What does TikTok’s audit actually review?
Audit reviewers use your app the way a real creator would: the OAuth consent screen, the scopes you request, the publish UI, and how you handle the privacy options TikTok's creator_info/query returns. They are checking that your app's actual behavior — not just your documentation — matches what you told TikTok you would do with the video.publish scope. Submit a stub or placeholder flow and expect a rejection, not a pass.
What actually changes once you pass?
Public posting becomes possible: an audited client can publish content that is visible beyond the author immediately, instead of being forced to SELF_ONLY. The 5-users-per-24-hours cap is replaced by a creator cap sized from the usage estimates in your application — so an accurate, conservative estimate on submission matters as much as passing at all. Full mechanics are covered in TikTok audited vs. unaudited client.
What does audit not unlock?
The Content Posting API surface is identical before and after — same endpoints, same request fields. And the per-creator daily posting ceiling (typically around 15 posts per creator per day via Direct Post) is structural, not a consequence of review status; passing audit does not raise it.
Budget for review time, and for a possible resubmission
Audit is not instant, and a rejection restarts a meaningful chunk of that clock. Get consent screens, scope requests, and privacy-level handling right on the first submission — a resubmission cycle is the single most common cause of a launch date slipping on a TikTok integration.
Can you skip your own app’s audit entirely?
PostGate's default TikTok integration connects your customers through PostGate's own developer app, which has already passed this exact audit. You get an already-audited client's posting caps and public visibility from day one, without registering a TikTok developer app or sitting through review yourself — and you can bring your own audited app in later on PostGate's white-label plan, once you have it.
Frequently asked questions
What changes after my TikTok app passes audit?
Public posting becomes possible: an audited client can publish content visible beyond the author immediately, instead of being forced to SELF_ONLY. The 5-users-per-24-hours cap is replaced by a creator cap sized from the usage estimates in your application, so an accurate, conservative estimate on submission matters as much as passing at all.
Does passing TikTok’s audit raise the daily posting limit?
No. The per-creator daily posting ceiling — typically around 15 posts per creator per day via Direct Post — is structural, not a consequence of review status, so passing audit does not raise it. The Content Posting API surface is also identical before and after: same endpoints, same request fields.
How long does the TikTok API audit take?
Audit is not instant, and a rejection restarts a meaningful chunk of that clock. Get consent screens, scope requests, and privacy-level handling right on the first submission — a resubmission cycle is the single most common cause of a launch date slipping on a TikTok integration.
Can I skip TikTok’s audit process entirely?
Yes, by not running your own app through it: PostGate’s default TikTok integration connects your customers through PostGate’s own developer app, which has already passed this exact audit. You get an already-audited client’s posting caps and public visibility from day one, and can bring your own audited app later on PostGate’s white-label plan.
