TikTok Sandbox for an Unaudited Client
How to test a TikTok integration safely before your app is audited, without risking real posting limits.
By André LugTest without burning TikTok’s 5-user unaudited cap: use a pg_test_ API key to route every request through PostGate’s simulated sandbox adapter, or connect a sandbox fixture profile — neither touches TikTok. Reserve a small, deliberate number of real TikTok connections for validating live behavior like privacy forcing, creator-info options, and processing delays.
Testing a TikTok integration before your own app passes audit means working around a real constraint: TikTok caps unaudited clients at a handful of distinct users within a rolling 24-hour window, and forces every post private. Burn that small cap on internal testing and demo accounts, and you may have none left when your first real customer tries to connect. PostGate gives you a way to build and validate the entire flow without ever touching that cap.
Two different things you need to test, separately
"Test my TikTok integration" usually means two distinct concerns: does my code call PostGate's API correctly (request shape, error handling, webhook consumption), and does the real TikTok posting experience behave the way I expect (privacy forcing, creator-info options, delivery status). PostGate's test mode covers the first without touching TikTok at all; a real unaudited connection covers the second, deliberately, in small numbers.
Start with a pg_test_ key — no real TikTok account needed
A pg_test_ API key routes every request through PostGate's simulated sandbox adapter, regardless of which platform the profile is actually connected to. Validation, job queueing, target status transitions, delivery logs, retries, and webhooks all behave exactly as they do in live mode — only the outbound call to TikTok itself is replaced with a simulated response. Build your entire integration — request shapes, error handling, webhook consumers — against this before a single real TikTok account is involved.
The sandbox platform, for a connectable fixture profile
Beyond test keys, sandbox is itself a connectable platform in PostGate — start a hosted connection with "platform": "sandbox" the same way you would for TikTok, no OAuth app or client secret required, and PostGate creates a fixture profile that always simulates delivery, even under a live key. Use it to demo your product's TikTok flow to stakeholders without any real TikTok account at all.
When do you actually need a real TikTok connection?
Some things — TikTok's real creator-info privacy options, real video processing time, real moderation and analytics delay — only show up against TikTok's live API. For that, connect a small, deliberate number of real TikTok accounts (your own team's, plus a few consenting testers) rather than every internal demo account you have. Every connection counts against the same rolling 5-user cap a real customer would use.
Set expectations on visibility while you test for real
Anything posted through a real unaudited connection lands SELF_ONLY regardless of the privacy level you request — that is TikTok's own restriction, not a bug in the flow you're testing. Tell your test accounts to expect a private post they can manually re-publish, and treatmode: "inbox" as the friendlier default while you validate, since it needs no privacy field at all. Full mechanics: TikTok audited vs. unaudited client.
Frequently asked questions
What does a pg_test_ API key actually simulate?
Everything except the outbound call to TikTok itself. Validation, job queueing, target status transitions, delivery logs, retries, and webhooks all behave exactly as they do in live mode — only the request to TikTok is replaced with a simulated response, so you can build request shapes, error handling, and webhook consumers before any real TikTok account is involved.
Why are my TikTok test posts private?
Anything posted through a real unaudited connection lands SELF_ONLY regardless of the privacy level you request — that is TikTok’s own restriction, not a bug in the flow you’re testing. Tell your test accounts to expect a private post they can manually re-publish.
How do I demo a TikTok flow without a real TikTok account?
Use the sandbox platform: start a hosted connection with "platform": "sandbox" the same way you would for TikTok, with no OAuth app or client secret required. PostGate creates a fixture profile that always simulates delivery, even under a live key — useful for demoing your product’s TikTok flow to stakeholders.
Do test connections count against TikTok’s user cap?
Real TikTok connections do — every one counts against the same rolling 5-user cap a real customer would use, so connect only a small, deliberate number of real accounts. Requests through pg_test_ keys and sandbox fixture profiles never touch TikTok, so they never touch the cap.
