Authentication

With the authorization code you receive after authorization by the business (the TikTok Business Account user), you can make a request to the endpoint /tt_user/oauth2/token/ to get an access_token for subsequent API requests and a refresh_token for access token renewal.

To get the TikTok Business Account permission scopes that are authorized by the business, you can pass the generated access token to /tt_user/token_info/get/.

Access token expiry

The access_token is valid for one day.

If an access token expires, you need to make a request to the /tt_user/oauth2/refresh_token/ endpoint to renew the access token. Remember to pass in the refresh_token for a token renewal request.

Refresh token expiry

The refresh_token is valid for one year.

If the refresh token expires, the developer needs to request the user to re-authorize their application via the user authorization workflow.

Obtain a short-term access token

Use this endpoint to get a TikTok account access token.

Request

Endpoint https://business-api.tiktok.com/open_api/v1.3/tt_user/oauth2/token/

Method POST

Header

|Field{30%}|Data Type{15%}|Description{55%}|
|---|---|---|
|Content-Type {required}|string|Request message type.<br>Allowed format: `application/json`.  |

Parameters

|Field{30%}|Data Type{15%}|Description{55%}|
|---|---|---|
| client_id {Required}  | string | ID of your developer app.<br><br> To find the <b>App ID</b>, navigate to [My Apps](https://ads.tiktok.com/marketing_api/apps/) > <b>App Detail</b> > <b>Basic Information</b>.|
| client_secret {Required}  | string | Secret of your developer app. <br><br>To find the <b>Secret</b>, navigate to [My Apps](https://ads.tiktok.com/marketing_api/apps/) > <b>App Detail</b> > <b>Basic Information</b>. |
| grant_type {Required}  | string | The way of generating the access token.<br><br> The allowed enum value: <ul><li>`authorization_code`: To generate the access token by authorization code.</li></ul> |
| auth_code {Required}  | string | The authorization code (`auth_code`) generated by your <b>TikTok account holder authorization URL</b>. <br><br>The code is valid for 10 minutes and can only be used once.<br><br>To find out how to get the authorization code based on the type of API you use, see the "<b>Authorization URL</b>" row in [Comparing authorization for different APIs](https://business-api.tiktok.com/portal/docs?id=1781891256601602#item-link-Comparing%20authorization%20for%20different%20APIs). |
| redirect_uri {Required}  | string | The redirect URL which the client will be directed to.<br><br> Its value must be the same as the <b>TikTok account holder redirect URL</b> set in the app. |

Example

(code curl http)
curl --location --request POST 'https://business-api.tiktok.com/open_api/v1.3/tt_user/oauth2/token/' \
--header 'Content-Type: application/json' \
--data '{
    "client_id":"{{client_id}}",
    "client_secret":"{{client_secret}}",
    "grant_type":"authorization_code",
    "auth_code":"{{auth_code}}",
    "redirect_uri":"{{redirect_uri}}"
}'
(/code)

Response

|Field{30%}|Data Type{15%}|Description{55%}|
|---|---|---|
|code |number|Response code. For the complete list of response codes and descriptions, see [Appendix - Return Codes](https://ads.tiktok.com/marketing_api/docs?id=1737172488964097).|
|message |string|Response message. For details, see [Appendix - Return Codes](https://ads.tiktok.com/marketing_api/docs?id=1737172488964097).|
|request_id|string| The log ID of the request, which uniquely identifies a request.|
|data|object|Returned data.|
#|access_token | string | The short-term token for permission verification. <br><br>The token expires in one day. |
#|token_type | string | The type of token.<br><br>Enum value: <ul><li>`Bearer`: Bearer token. Anyone in possession of the token can use it to access the associated resources.</li></ul> |
#|scope | string | The scope of permissions granted to the access token. |
#|expires_in | number | The time remaining until the access token expires, measured in seconds. |
#|refresh_token | string | The refresh token, which can be used to renew the access token.<br><br> The refresh token is valid for one year.<br><br><p><span style="color:darkred"><b>Note</b></span>: Retain this field for `access_token` renewal. |
#|refresh_token_expires_in | number | The time remaining until the refresh token expires, measured in seconds. |
#|open_id | string | Application specific unique ID of the TikTok account. |

Example

(code Success-Response http)
HTTPS/1.1 200 OK
{
    "code": 0,
    "message": "OK",
    "request_id": "{{request_id}}",
    "data": {
        "access_token": "{{access_token}}",
        "expires_in": 86400,
        "open_id": "{{open_id}}",
        "refresh_token": "{{refresh_token}}",
        "refresh_token_expires_in": 31536000,
        "scope": "message.list.manage,video.list,video.insights,user.insights,user.info.basic,comment.list,biz.brand.insights,biz.spark.auth,tcm.order.update,comment.list.manage,video.upload,video.publish,biz.ads.recommend,user.account.type,biz.creator.info,user.info.username,message.list.send,user.info.profile,user.info.stats,message.list.read,biz.creator.insights",
        "token_type": "Bearer"
    }
}
(/code)

Renew a short-term access token

Use this endpoint to renew a short-term TikTok account access token by refresh_token.

Request

Endpoint https://business-api.tiktok.com/open_api/v1.3/tt_user/oauth2/refresh_token/

Method POST

Header

|Field{30%}|Data Type{15%}|Description{55%}|
|---|---|---|
|Content-Type {required}|string|Request message type.<br>Allowed format: `application/json`.  |

Parameters

|Field{30%}|Data Type{15%}|Description{55%}|
|---|---|---|
| client_id {Required}  | string | ID of your developer app.<br><br> To find the <b>App ID</b>, navigate to [My Apps](https://ads.tiktok.com/marketing_api/apps/) > <b>App Detail</b> > <b>Basic Information</b>.|
| client_secret {Required}  | string | Secret of your developer app. <br><br>To find the <b>Secret</b>, navigate to [My Apps](https://ads.tiktok.com/marketing_api/apps/) > <b>App Detail</b> > <b>Basic Information</b>. |
| grant_type {Required} | string | The way of generating the access token.<br><br>The allowed enum value: <ul><li>`refresh_token`: To generate the access token by refresh token.</li></ul>|
| refresh_token {Required} | string | Refresh token to renew an existing access token.<br><br>You can obtain the refresh token in the response of <a href="#item-link-Obtain a short-term access token">/tt_user/oauth2/token/</a> endpoint when you generate an access token. |

Example

(code curl http)
curl --location --request POST 'https://business-api.tiktok.com/open_api/v1.3/tt_user/oauth2/refresh_token/' \
--header 'Content-Type: application/json' \
--data '{
    "client_id":"{{client_id}}",
    "client_secret":"{{client_secret}}",
    "grant_type":"refresh_token",
    "refresh_token":"{{refresh_token}}"
}'
(/code)

Response

|Field{30%}|Data Type{15%}|Description{55%}|
|---|---|---|
|code |number|Response code. For the complete list of response codes and descriptions, see [Appendix - Return Codes](https://ads.tiktok.com/marketing_api/docs?id=1737172488964097).|
|message |string|Response message. For details, see [Appendix - Return Codes](https://ads.tiktok.com/marketing_api/docs?id=1737172488964097).|
|data|object|Returned data.|
|request_id|string| The log ID of the request, which uniquely identifies a request.|
#|access_token | string | The new short-term token for permission verification. <br><br>The token expires in one day. |
#|token_type | string | The type of token.<br><br>Enum value: <ul><li>`Bearer`: Bearer token. Anyone in possession of the token can use it to access the associated resources.</li></ul> |
#|scope | string | The scope of permissions granted to the access token. |
#|expires_in | number | The time remaining until the access token expires, measured in seconds. |
#|refresh_token | string | The refresh token, which can be used to renew the access token.<br><br> The refresh token is valid for one year.<br><br><p><span style="color:darkred"><b>Note</b></span>: Retain this field for `access_token` renewal. |
#|refresh_token_expires_in | number | The time remaining until the refresh token expires, measured in seconds. |
#|open_id | string | Application specific unique ID of the TikTok account. |

Example

(code Success-Response http)
HTTPS/1.1 200 OK
{
    "code": 0,
    "message": "OK",
    "request_id": "{{request_id}}",
    "data": {
        "access_token": "{{access_token}}",
        "expires_in": 86400,
        "open_id": "{{open_id}}",
        "refresh_token": "{{refresh_token}}",
        "refresh_token_expires_in": 28484364,
        "scope": "message.list.manage,video.list,video.insights,user.insights,user.info.basic,comment.list,biz.brand.insights,biz.spark.auth,tcm.order.update,comment.list.manage,video.upload,video.publish,biz.ads.recommend,user.account.type,biz.creator.info,user.info.username,message.list.send,user.info.profile,user.info.stats,message.list.read,biz.creator.insights",
        "token_type": "Bearer"
    }
}
(/code)