# TikTok Content Posting API: a practical guide to posting videos and photos Canonical: https://status200uploads.com/platforms/tiktok/api-guide Checked on 26 October 2026. TikTok's Content Posting API posts videos and photo posts to a creator's account in two ways: Direct Post publishes to the profile, and Upload sends a draft to the creator's TikTok inbox. Your app needs TikTok's app review for the video.publish or video.upload scope, and until it passes TikTok's audit, everything it posts is private (SELF_ONLY). This guide sums up TikTok's own developer pages, read on 15 October 2026. Sources read on 15 October 2026. ## Direct Post or Upload: the two ways to post Direct Post publishes a video or a photo post straight to the creator's profile, with the privacy and interaction settings your app sends. It needs the video.publish scope, which TikTok describes as "Directly post content to a user's TikTok profile." [T18, T10] Upload sends the content to the creator's TikTok inbox as a draft, under the video.upload scope. The creator then finishes the post in TikTok's own editing flow; TikTok asks apps to tell users they must open the inbox notification to complete it. [T18, T5, T6] Photo posts use one endpoint for both, POST /v2/post/publish/content/init/, with post_mode DIRECT_POST (needs video.publish) or MEDIA_UPLOAD (needs video.upload) and media_type PHOTO, which TikTok says is currently the only value allowed. Every call goes to https://open.tiktokapis.com. [T7, T3, T8] ## Who can get access: app review, the audit and private-only posts You register an app, add the Content Posting API product, turn on the Direct Post configuration and get video.publish approved; each creator then authorizes your app. App review wants a working website with a Privacy Policy and Terms on it, a description, and at least one demo video of the whole flow (up to 5 videos of up to 50 MB each). TikTok states that apps still in development or testing, and apps for private or personal use, are not approved, and that unused products and scopes delay the review. [T1, T13] App review is not the audit. In TikTok's words, "All content posted by unaudited clients will be restricted to private viewing mode." Until your app passes the audit, at most 5 users can post through it in 24 hours, their accounts must be private when they post, and every post is SELF_ONLY. A post to a public account from an unaudited app fails with unaudited_client_can_only_post_to_private_accounts. [T1, T2, T9] How long review and the audit take: not listed. None of TikTok's posting pages gives a time, and the audit form itself is behind a developer login. [T1, T9, T13] TikTok lists two uses it does not accept for the API: an app that copies arbitrary content from other platforms to TikTok, and a utility that uploads to accounts you or your team manage. API clients must be meant for a wide audience, not limited to test applications. [T9] - Sandbox: up to 5 sandboxes per app and up to 10 of your own accounts in each. TikTok states that Sandbox mode does not offer the Content Posting API for public videos. [T14] ## Scopes, sign-in and tokens - Scopes: video.publish (Direct Post), video.upload (Upload), and user.info.basic to read the creator's open id, avatar and display name. [T10] - Sign-in: Login Kit uses OAuth 2.0. Send the creator to https://www.tiktok.com/v2/auth/authorize/ with response_type=code, a comma-separated scope list and a state value against cross-site request forgery. [T12] - Redirect addresses: at most 10, each under 512 characters, absolute https, static (no query string, no fragment), registered in Login Kit. [T12] - Access tokens last 24 hours (expires_in 86400). Refresh tokens last 365 days and refresh without asking the creator again. A refresh can return a different refresh token, and TikTok says you must keep the new one. [T11] - To end access, revoke the token with POST https://open.tiktokapis.com/v2/oauth/revoke/. [T11] ## Posting a video, step by step (Direct Post) 1. Ask what the creator may post: POST /v2/post/publish/creator_info/query/ (20 requests a minute per user token). It returns the nickname and avatar to show, privacy_level_options, whether comments, Duet and Stitch are off for the account, and max_video_post_duration_sec. Public accounts can pick PUBLIC_TO_EVERYONE, MUTUAL_FOLLOW_FRIENDS or SELF_ONLY; private accounts FOLLOWER_OF_CREATOR, MUTUAL_FOLLOW_FRIENDS or SELF_ONLY. [T3] 2. Start the post: POST /v2/post/publish/video/init/ (6 requests a minute per user token). post_info carries privacy_level, which must be one of the creator's privacy_level_options, the title (the caption, up to 2,200 UTF-16 runes), disable_duet, disable_stitch, disable_comment, video_cover_timestamp_ms, the commercial-content toggles and is_aigc for the AI-generated label. source_info says FILE_UPLOAD (with video_size, chunk_size and total_chunk_count) or PULL_FROM_URL (with video_url). [T2] 3. For FILE_UPLOAD, send the file to the returned upload_url in chunks with PUT, each with Content-Type, Content-Length and Content-Range: bytes first-last/total. TikTok says chunks must go in order, and the upload_url is valid for one hour. [T2, T4] 4. Follow the post: POST /v2/post/publish/status/fetch/ with the publish_id (30 requests a minute). It moves through PROCESSING_UPLOAD or PROCESSING_DOWNLOAD to PUBLISH_COMPLETE, or FAILED with a fail_reason. TikTok gives processing times of under half a minute for 512 MB, about a minute for 1 GB and more than two minutes for 4 GB. [T8] 5. Public posts are moderated. TikTok says moderation usually finishes within a minute and can take a few hours; the public post id (publicaly_available_post_id, TikTok's spelling) arrives only once a public post has passed. [T8] Start a Direct Post video upload (TikTok's API, not ours) ```bash curl -X POST 'https://open.tiktokapis.com/v2/post/publish/video/init/' \ -H 'Authorization: Bearer {user_access_token}' \ -H 'Content-Type: application/json; charset=UTF-8' \ -d '{ "post_info": { "title": "Behind the scenes #studio", "privacy_level": "PUBLIC_TO_EVERYONE", "disable_duet": false, "disable_stitch": false, "disable_comment": false }, "source_info": { "source": "FILE_UPLOAD", "video_size": 50000123, "chunk_size": 10000000, "total_chunk_count": 5 } }' ``` ## What TikTok asks of a Direct Post app's screens TikTok's Content Sharing Guidelines describe the posting screen an audited app must show. They are rules for your interface, checked in the audit, not fields of the API. [T9] - Show the creator's nickname, and a preview of the content before it is sent. [T9] - Privacy: in TikTok's words, "Users must manually select the privacy status from a dropdown and there should be no default value." [T9] - Comments, Duet and Stitch start off and are greyed out when creator_info says the account has them off; check the video length against max_video_post_duration_sec. [T9, T3] - Commercial content disclosure starts off, with the labels "Promotional content" (your brand) and "Paid partnership" (branded content). Branded content cannot be private. [T9] - Before the post button, show "By posting, you agree to TikTok's Music Usage Confirmation", send only after the user's express consent, add no watermarks or logos of your own, and tell users that processing may take a few minutes. [T9] ## Photo posts - Endpoint: POST /v2/post/publish/content/init/ with media_type PHOTO. TikTok allows only PULL_FROM_URL for photos: photo_images is an array of up to 35 photo URLs, which must be public and verified by your app, and photo_cover_index picks the cover (counting from 0). [T7] - Text: a title of up to 90 UTF-16 runes and a description of up to 4,000. privacy_level is required for Direct Post; disable_comment, auto_add_music (Direct Post only), the commercial-content toggles and is_aigc are optional. [T7] - Images: WebP or JPEG, at most 1080p, at most 20 MB each. [T4] - MEDIA_UPLOAD photo drafts fail with app_version_check_failed when the creator's TikTok app is older than version 31.8. [T7] ## Media specs | Item | TikTok's rule | | --- | --- | | Video formats | MP4 (recommended), WebM, MOV | | Codecs | H.264 (recommended), H.265, VP8, VP9 | | Frame rate | 23 to 60 frames a second | | Picture size | 360 to 4,096 pixels, height and width | | Length | Every creator can post 3-minute videos; some have 5 or 10 minutes. The init endpoint takes at most 10 minutes. Per creator: max_video_post_duration_sec. | | Video file size | Up to 4 GB | | Chunks | At least 5 MB and at most 64 MB each, the last one up to 128 MB; 1 to 1,000 chunks; total_chunk_count is video_size divided by chunk_size, rounded down. A file under 5 MB goes in one piece. | | Photos | WebP or JPEG, at most 1080p, at most 20 MB each | | PULL_FROM_URL | A verified domain or URL prefix (a domain, not an IP address), https, no redirects. TikTok gives up on the download one hour after it starts. | Sources: [T4, T3] ## Limits and rate limits - Per user access token, per minute: creator_info 20, video init 6, photo init 6, inbox video init 6, status fetch 30. TikTok counts them in a one-minute sliding window and takes requests for higher limits through its support page. [T3, T2, T7, T6, T8, T16] - Posts per creator with Direct Post: TikTok says the limit varies, typically around 15 posts a day per creator account, shared across every app that posts for it (error spam_risk_too_many_posts). [T9] - Upload drafts: at most 5 pending shares in any 24 hours (spam_risk_too_many_pending_share). [T6, T7] - Creators per app: a 24-hour cap on active creators, set from the usage you estimated in the audit form (reached_active_user_cap). [T9] ## Errors TikTok returns Every TikTok error has an error object with code, message and log_id, and TikTok says any code other than ok means the request did not succeed. [T15, T3] | HTTP | Code | What it means | | --- | --- | --- | | 400 | invalid_param | A field is missing or wrong. | | 401 | access_token_invalid | The token is expired or revoked. | | 401 | scope_not_authorized | The creator did not grant the scope the call needs. | | 403 | spam_risk_too_many_posts | The creator's daily post limit through apps. | | 403 | spam_risk_user_banned_from_posting | The account may not post now. | | 403 | reached_active_user_cap | The app's 24-hour cap on active creators. | | 403 | unaudited_client_can_only_post_to_private_accounts | The app is not audited and the account is public. | | 403 | url_ownership_unverified | PULL_FROM_URL from a domain or prefix the app has not verified. | | 403 | privacy_level_option_mismatch | The privacy level is not one of the creator's options. | | 429 | rate_limit_exceeded | Too many requests in the minute. | Sources: [T2, T6, T7, T15] - After TikTok accepted a post, status fetch can report FAILED with a fail_reason: file_format_check_failed, duration_check_failed, frame_rate_check_failed, picture_size_check_failed, video_pull_failed or photo_pull_failed (the download failed or passed the one-hour limit), publish_cancelled, auth_removed, spam_risk_text or internal. TikTok marks internal as one to retry, and auth_removed and the spam_risk reasons as ones not to. [T8] ## What changed recently TikTok's developer changelog (last updated August 26, 2026) has no Content Posting API entry in 2025 or 2026. The Direct Post and Photo Post references show "Last updated August 24, 2026" without saying what changed. [T17, T2, T7] - 27 April 2023: the Content Posting API launched. 23 May 2023: video upload by URL. 7 June 2023: Direct Post. 3 November 2023: photo posts. [T17] - 24 June 2024: Sandbox mode and review guidelines. 9 September 2024: URL ownership verification became mandatory for PULL_FROM_URL. [T17] ## Gotchas developers hit - Passing app review does not lift private-only posting: only the audit does. [T1, T9, T13] - creator_info answers HTTP 200 for spam_risk_too_many_posts, spam_risk_user_banned_from_posting and reached_active_user_cap: read error.code, not only the status. [T3] - Never hard-code a privacy level: it must be one of that creator's privacy_level_options, or the init fails with privacy_level_option_mismatch. [T2, T3] - A 10-minute file can still be too long for a creator. TikTok says users may trim videos sent by an app inside the TikTok app to fit their account's maximum. [T3, T4] - A SELF_ONLY post, or a public one still in moderation, has no public post id, so there is no link to share yet. [T8] - Photos go by URL only, from a verified domain or prefix, over https and without redirects. [T4, T7] ## Posting to TikTok through Status 200 Uploads Status 200 Uploads posts to TikTok through its own TikTok app: you sign in on TikTok itself and never register a developer app or go through the review and audit above. The facts below are the ones our TikTok page shows, as checked on that page's own date. - **What you can post:** One video, or a photo post of one or more photos. TikTok does not mix photos and a video in one post. - **Largest video:** 4 GB per file. - **Largest image:** 20 MB per image. - **Text:** A video has one caption of up to 2,200 characters. A photo post has a title of up to 90 characters and a description of up to 4,000. - **Scheduling:** Schedule a post up to 365 days ahead, or send it now. - **Your own TikTok app:** Not needed. Posts go through our TikTok app, which TikTok lets post publicly, so you never register a developer app of your own. Settings you can choose: Who can see it, Comments off, Duet off, Stitch off, Your brand, AI-generated label, Auto music, Photo title, Photo description. ## Questions ### Does TikTok have an official API for posting videos? Yes. TikTok's Content Posting API has Direct Post, which publishes to the creator's profile under the video.publish scope, and Upload, which sends a draft to the creator's TikTok inbox under video.upload. Photo posts use the same API. ### Why are my TikTok API posts private? TikTok restricts everything an unaudited app posts to private viewing (SELF_ONLY), allows it only for accounts that are private when they post, and caps it at 5 posting users in 24 hours, until the app passes TikTok's audit. ### How long does the TikTok Content Posting API audit take? Not listed. TikTok's pages give no time for app review or for the audit. ### How many posts a day can I make through the TikTok API? With Direct Post, TikTok says the limit varies by creator, typically around 15 posts a day per account, shared across all apps. Upload allows at most 5 pending drafts in 24 hours, and each app has a 24-hour cap on active creators. ### Which video formats does the TikTok API accept? MP4, WebM or MOV, in H.264, H.265, VP8 or VP9, at 23 to 60 frames a second, 360 to 4,096 pixels a side and up to 4 GB. The longest video depends on the creator: read max_video_post_duration_sec. ### How long do TikTok access tokens last? 24 hours. Refresh tokens last 365 days, and a refresh can return a new refresh token that you must keep. ### What does url_ownership_unverified mean? Your app used PULL_FROM_URL with an address whose domain or URL prefix is not verified in the app's settings. TikTok made the verification mandatory on 9 September 2024. ## More on TikTok - [TikTok](https://status200uploads.com/platforms/tiktok) - [TikTok errors](https://status200uploads.com/platforms/tiktok/errors) ## Related - [Instagram](https://status200uploads.com/platforms/instagram) - [YouTube](https://status200uploads.com/platforms/youtube) - [REST API](https://status200uploads.com/integrations/rest-api) - [Python](https://status200uploads.com/integrations/python) - [AI agents (MCP)](https://status200uploads.com/integrations/mcp) - [The API reference](https://status200uploads.com/docs/api) - [File limits of every network](https://status200uploads.com/docs/file-limits) ## TikTok's own pages Sources read on 15 October 2026. - T1. [Get Started: Direct Post](https://developers.tiktok.com/doc/content-posting-api-get-started) (last updated August 4, 2026) - T2. [Direct Post reference](https://developers.tiktok.com/doc/content-posting-api-reference-direct-post) (last updated August 24, 2026) - T3. [Query Creator Info](https://developers.tiktok.com/doc/content-posting-api-reference-query-creator-info) (last updated August 4, 2026) - T4. [Media Transfer Guide](https://developers.tiktok.com/doc/content-posting-api-media-transfer-guide) (last updated August 4, 2026) - T5. [Get Started: Upload](https://developers.tiktok.com/doc/content-posting-api-get-started-upload-content) (last updated August 4, 2026) - T6. [Upload reference](https://developers.tiktok.com/doc/content-posting-api-reference-upload-video) (last updated August 4, 2026) - T7. [Photo Post reference](https://developers.tiktok.com/doc/content-posting-api-reference-photo-post) (last updated August 24, 2026) - T8. [Get Post Status](https://developers.tiktok.com/doc/content-posting-api-reference-get-video-status) (last updated August 4, 2026) - T9. [Content Sharing Guidelines](https://developers.tiktok.com/doc/content-sharing-guidelines) (last updated August 4, 2026) - T10. [Scopes overview](https://developers.tiktok.com/doc/tiktok-api-scopes) - T11. [Manage User Access Tokens](https://developers.tiktok.com/doc/oauth-user-access-token-management) (last updated August 4, 2026) - T12. [Login Kit for Web](https://developers.tiktok.com/doc/login-kit-web) (last updated August 4, 2026) - T13. [App Review Guidelines](https://developers.tiktok.com/doc/app-review-guidelines) (last updated August 4, 2026) - T14. [Sandbox](https://developers.tiktok.com/doc/add-a-sandbox) (last updated August 4, 2026) - T15. [Error handling](https://developers.tiktok.com/doc/tiktok-api-v2-error-handling) (last updated August 4, 2026) - T16. [Rate limits](https://developers.tiktok.com/doc/tiktok-api-v2-rate-limit) (last updated August 4, 2026) - T17. [Changelog](https://developers.tiktok.com/doc/changelog) (last updated August 26, 2026) - T18. [Content Posting API product page](https://developers.tiktok.com/products/content-posting-api/)