Skip to main content

Connecting TikTok

TikTok is the most involved platform to set up — not because any single step is hard, but because it's easy to mix up Sandbox and Production credentials, and because TikTok gates real posting behind an app review most indie developers won't clear right away. This guide walks through the setup people actually get stuck on.

What connecting TikTok enables today

Stitchable posts straight to your TikTok profile (Direct Post) — no opening the TikTok app to finish it. The one thing no app can skip: TikTok forces every post from an unaudited app to private (visible only to you), regardless of what privacy setting is requested. Real, public posting needs TikTok's own compliance audit — see Going public below. Until then, this is genuinely the full flow end to end: Stitchable calls TikTok's creator_info endpoint first (so it can show your TikTok username before posting, one of TikTok's hard audit requirements) and uploads the video for real — it just lands private.

1. Register a TikTok developer app​

  1. Go to developers.tiktok.com and sign in (or register).
  2. Create an Organization first — TikTok requires one before you can create an app under it.
  3. Inside that organization, create an App.
  4. In the app's dashboard, add the Content Posting API product.
  5. Configure a Sandbox for the app — this is where you'll do all your testing.

2. The Sandbox vs. Production gotcha​

TikTok issues two separate Client key / Client secret pairs for every app: one for Sandbox, one for Production. They are not interchangeable.

Use the Sandbox credentials while testing

While you're testing, copy the Sandbox Client key and Client secret — not the app's main/production ones. Pasting the wrong pair into Stitchable produces an opaque failure that looks like this:

We couldn't log in with TikTok... correct the following: client_key

That error is almost always this exact mismatch: Sandbox credentials used against a production-configured flow, or vice versa. Double-check which pair you copied before troubleshooting anything else.

3. Add yourself (and testers) as Target users​

Until your app passes TikTok's App Review, only accounts explicitly added as Target users can authorize or post through it — this applies even to your own TikTok account.

  1. In the Sandbox configuration, find Target users.
  2. Add the exact TikTok username of every account that needs to test this (yours included).

Any account not on this list will be unable to complete sign-in through your app at all, no matter how correctly everything else is configured.

4. Set the redirect URI​

Stitchable runs a local OAuth callback on your machine (127.0.0.1) with a port it picks freshly each time you connect — so a specific port can't be pre-registered. Register http://127.0.0.1:*/callback as the app's redirect URI in TikTok's Login Kit settings, using the literal * wildcard. TikTok's own Login Kit documentation requires every redirect URI to include a port, and specifically calls out the * wildcard for apps that use a random port like Stitchable does — registering a portless http://127.0.0.1/callback will not match and will fail every sign-in attempt.

5. Connect it in Stitchable​

  1. Open the connect wizard from the Publishing page and choose TikTok.
  2. Paste the Sandbox Client key into Client ID and the Sandbox Client secret into Client secret.
  3. Click Save & continue.
  4. Click Sign in with TikTok. A browser window opens TikTok's real sign-in page.
  5. Log in with an account you added as a Target user in step 3, and approve.
  6. The wizard finishes automatically once you approve.
Already connected TikTok before?

Reconnect it — Stitchable now requests the video.publish scope (Direct Post) alongside the original video.upload, and TikTok doesn't retroactively add a scope to a connection you made before this change. Same wizard, same steps above.

Going public​

Every post from an app TikTok hasn't audited comes back private (SELF_ONLY) — visible only to the posting account, not followers, not the For You page, nobody else. This is enforced by TikTok, not Stitchable; no setting here changes it.

To lift that, the app itself needs to pass TikTok's compliance audit — a real review (typically 2–4 weeks, often multiple rounds of feedback) that checks for:

  • A clear, legitimate use-case description for why the app publishes to TikTok
  • Showing the creator's username/avatar before every post (Stitchable already does this via the creator_info call)
  • A demo video of the actual posting flow — the setup in this guide, working, is exactly that demo
  • A real privacy policy that covers TikTok data handling (a placeholder page doesn't pass)
  • Requesting only the scopes actually used

Until that audit passes, treat every TikTok post from Stitchable as a private test — nobody else can see it no matter what.

Troubleshooting​

  • Stitchable says the post succeeded, but I can't find it anywhere on TikTok — not my profile, not TikTok Studio. Check the TikTok app itself, logged in as the account you connected — it's there, just private (SELF_ONLY). This is TikTok's own unaudited-app restriction, not a Stitchable bug — see Going public above.
  • "We couldn't log in with TikTok... correct the following: client_key" — you pasted the wrong credential pair. See step 2 above.
  • "Code verifier or code challenge is invalid" — this is not a PKCE bug on Stitchable's side. TikTok's PKCE implementation deviates from the standard (it wants a hex-encoded SHA-256 challenge, not the usual base64url one), and Stitchable already handles that correctly. If you see this error, the real cause is almost always a redirect URI mismatch or a Sandbox/Production credential mismatch — recheck steps 2 and 4 above.
  • Sign-in or posting fails for an account that isn't the one you tested with. This is expected, not a bug — until your app passes TikTok's App Review, only accounts explicitly added as Target users (step 3) can sign in or post through it at all, including your own account if you forgot to add it. Going live for arbitrary TikTok accounts requires TikTok's own App Review process, which can take real time and is selective about what it approves — budget for that realistically before promising this to anyone outside your test group.
  • A connected account shows "needs reauth." The TikTok session Stitchable was using has expired or been revoked — common causes include the token aging out or you revoking access from TikTok's own security settings. Open the connect wizard again, choose TikTok, and go through Sign in with TikTok as if connecting fresh; this replaces the expired session without losing your existing posts or history.