Guides · 2026-11-07

A practical guide to the TikTok Content Posting API

TikTok allows automated video posting through its official Content Posting API, but with stricter rules than most other platforms. This guide explains the flow, the limits and why some tools can only post privately.

TikTok offers two ways to send videos to an account through its API. Direct Post publishes the video immediately with the caption and settings you send. Upload to inbox puts the video into the creator's TikTok inbox, where they finish and publish it in the app. Both use the same Content Posting API, but different permissions: video.publish for Direct Post and video.upload for the inbox.

Step 1: sign-in with Login Kit

The creator signs in with TikTok and grants the app access. A typical tool asks for user.info.basic (name and avatar), video.publish and, if needed, video.upload. The access token is valid for two hours, the refresh token for 180 days. Each refresh returns a new refresh token, so a tool has to store it reliably every time.

Step 2: query creator_info before every post

This step is mandatory and often missed. Before a post is prepared, the app must call creator_info/query. The response tells you:

• the creator's nickname, username and avatar,
• which privacy levels the account allows (privacy_level_options),
• whether comments, duets and stitches are disabled in the account,
• the maximum video length the creator may post (max_video_post_duration_sec).

The privacy level you send later must be one of the returned options. Otherwise TikTok rejects the post with privacy_level_option_mismatch. If creator_info says the creator cannot post right now, the tool should stop and tell the user.

Step 3: initialise and upload

The upload starts with an init request. It contains the caption (up to 2,200 characters), the privacy level, the interaction settings, optional disclosures for branded or AI-generated content, and information about the file.

TikTok accepts the file in two ways:

• FILE_UPLOAD: the tool sends the file in chunks to an upload URL that is valid for one hour.
• PULL_FROM_URL: TikTok downloads the video from an HTTPS URL. The domain must be verified in the TikTok developer portal.

The chunk rules for FILE_UPLOAD are precise:

Supported formats are MP4 (recommended), MOV and WebM. Via the API, videos can be up to ten minutes, but the creator's own limit from creator_info applies.

Step 4: check the status

After the upload, TikTok processes the video. The status is available through a status endpoint or through TikTok webhooks. Processing can take a few minutes, and the user should see that.

The audit and private-only posting

This is the point that surprises most teams. As long as an app has not passed TikTok's Direct Post audit:

• every post is published as SELF_ONLY, meaning only the creator can see it,
• the creator's account must be set to private at the time of posting,
• at most 5 users can post through the app within 24 hours.

The audit is a separate application after the app review. TikTok checks the user interface: the creator's name and avatar must be visible, the privacy level must be chosen by the user without a preset, comment, duet and stitch must be off by default, commercial content must be declared with the right labels, and the user must agree to TikTok's Music Usage Confirmation before posting.

The inbox upload is not affected by the SELF_ONLY rule, because the creator publishes manually in the app. It is a reasonable path while an audit is pending.

We are open about this on our own product: the current review status of our TikTok app is listed in the FAQ. If a provider promises fully public TikTok posting, it is fair to ask whether their app has passed the audit.

Limits that apply after the audit

• 6 init requests per minute per access token.
• About 15 posts per day per creator account, shared across all tools the creator uses.
• A daily cap of active creators per app, set during the audit.

Errors such as spam_risk_too_many_posts or rate_limit_exceeded mean the limit has been reached. A scheduler should not retry these immediately.

TikTok with Video Automation

In the dashboard, Video Automation loads creator_info when you plan a TikTok post and shows only the privacy options your account allows. Through the API you send the same fields as with Upload-Post:

curl -X POST https://my-video-automation.com/api/upload \
  -H "Authorization: Apikey YOUR_KEY" \
  -F user=studio-north \
  -F "platform[]=tiktok" \
  -F title="Three tips for better light in small rooms" \
  -F privacy_level=PUBLIC_TO_EVERYONE \
  -F disable_comment=false \
  -F disable_duet=false \
  -F disable_stitch=false \
  -F is_aigc=false \
  -F video=@light-tips.mp4 \
  -F scheduled_date=2026-11-15T18:00:00 \
  -F timezone=Europe/Berlin

If a field is not supported for the connection, the post is not rejected; the response contains a warnings array instead. Use post_mode=MEDIA_UPLOAD if you want the video to land in the inbox as a draft.

Revoking access

A creator can remove the app at any time in the TikTok app under the settings for apps and services that have access to the account. TikTok then informs us, and we delete the connection and its tokens. More on this in the privacy policy.

Summary

The TikTok Content Posting API is usable for automation, but it expects that the creator stays in control: fresh creator_info for each post, explicit privacy choice and clear disclosures. Plan time for the app review and audit, and keep the daily limits in mind. For YouTube, see scheduling Shorts automatically; for the full endpoint list, the API documentation.