> ## Documentation Index
> Fetch the complete documentation index at: https://docs.markifact.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom TikTok App

> Connect a TikTok account through your own TikTok app (white-label) by pasting your client key, client secret, and a refresh token.

Markifact supports two ways to connect a TikTok account for organic publishing and reporting: using the built-in **Markifact app** (Quick Connect) or connecting through your own **TikTok app** (Custom App). With a custom app, the account holder authorizes your app, and every request Markifact makes runs under it, so your clients never see Markifact in their connected apps.

<Note>
  Custom app connections are available on the **Team** plan. See [White-label Connections](/core-concepts/white-label-connections) for the overview.
</Note>

***

## Quick Connect vs Custom App

| Feature                         | Quick Connect        | Custom App                           |
| :------------------------------ | :------------------- | :----------------------------------- |
| **Setup Time**                  | 1 minute             | 30 minutes, plus TikTok's app review |
| **App the account holder sees** | Markifact            | Yours                                |
| **API rate limits**             | Markifact's app      | Your app                             |
| **White Label**                 | No                   | Yes                                  |
| **Plan**                        | All plans            | Team                                 |
| **Best For**                    | Quick setup, testing | Agencies, strict client requirements |

***

## What You Need

Three values from your own TikTok app:

| Value             | Where it comes from                                                                                            |
| :---------------- | :------------------------------------------------------------------------------------------------------------- |
| **Client Key**    | Your app's page in the TikTok for Developers portal                                                            |
| **Client Secret** | The same page                                                                                                  |
| **Refresh Token** | Issued when the account holder authorizes your app with the scopes below, then exchanged as shown in the steps |

TikTok access tokens last 24 hours, so Markifact refreshes them with your client key and secret on every run. Refresh tokens last 365 days and **rotate on every refresh**: Markifact stores the newest one automatically, so once connected you do not have to touch the connection again.

<Note>
  **Already have your own authorization flow?** If your systems already hold a Login Kit refresh token issued by your app, skip to [Connect to Markifact](#connect-to-markifact). Paste the latest refresh token you hold: an older, already-rotated one is rejected.
</Note>

### Scopes

Request all of these when the account holder authorizes. Missing scopes surface later as TikTok permission errors on the node.

| Scope                              | Needed for                         |
| :--------------------------------- | :--------------------------------- |
| `user.info.basic`                  | Identifying the account (required) |
| `user.info.stats`, `user.insights` | Account performance                |
| `video.list`, `video.insights`     | Listing posts and post performance |
| `video.publish`, `video.upload`    | Publishing                         |

***

## Setting Up Your Custom TikTok App

<Steps>
  <Step title="Create the App">
    1. Go to the [TikTok for Developers portal](https://developers.tiktok.com/) and create an app
    2. Add the **Login Kit** and **Content Posting API** products, and request the scopes listed above
    3. Under Login Kit, add a **Redirect URI** you control (for example `https://www.youragency.com/tiktok-callback`). TikTok appends the auth code to this URL after authorization; the page does not need to do anything
    4. Submit the app for review and wait for TikTok to approve the scopes. Agencies that already run their own integrations will have this in place
  </Step>

  <Step title="Get the Client Key and Secret">
    Open your app's page in the portal and copy the **Client key** and **Client secret**.
  </Step>

  <Step title="Generate a PKCE Pair">
    TikTok requires PKCE, and unlike most providers it expects the challenge as the **hex** encoding of the SHA-256 hash. Run this in a terminal and keep both values:

    ```bash theme={"dark"}
    CODE_VERIFIER=$(openssl rand -hex 32)
    CODE_CHALLENGE=$(printf "%s" "$CODE_VERIFIER" | openssl dgst -sha256 | awk '{print $NF}')
    echo "verifier:  $CODE_VERIFIER"
    echo "challenge: $CODE_CHALLENGE"
    ```
  </Step>

  <Step title="Authorize and Get the Auth Code">
    1. Open the following URL in a browser, replacing the client key, redirect URI, and challenge:

    ```bash theme={"dark"}
    https://www.tiktok.com/v2/auth/authorize/?client_key=YOUR_CLIENT_KEY&scope=user.info.basic,user.info.stats,user.insights,video.list,video.insights,video.publish,video.upload&response_type=code&redirect_uri=https%3A%2F%2Fwww.youragency.com%2Ftiktok-callback&state=markifact&code_challenge=YOUR_CHALLENGE&code_challenge_method=S256
    ```

    2. Sign in as the TikTok account you want to connect and click **Authorize**
    3. TikTok redirects to your URL with `code=...` in the query string. Copy the value. Auth codes expire quickly and can be exchanged once, so do the next step right away
  </Step>

  <Step title="Exchange the Auth Code for Tokens">
    Run this request, replacing the values (the redirect URI must match the one used above exactly):

    ```bash theme={"dark"}
    curl -X POST "https://open.tiktokapis.com/v2/oauth/token/" \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "client_key=YOUR_CLIENT_KEY" \
      -d "client_secret=YOUR_CLIENT_SECRET" \
      -d "code=THE_AUTH_CODE" \
      -d "grant_type=authorization_code" \
      -d "redirect_uri=https://www.youragency.com/tiktok-callback" \
      -d "code_verifier=YOUR_VERIFIER"
    ```

    The response contains `refresh_token`. Copy it.

    > **Important:** Keep this token secure. Anyone holding it, together with your client key and secret, can post to and read the connected TikTok account.
  </Step>

  <Step title="Connect to Markifact">
    1. In Markifact, go to the [Connections](https://app.markifact.com/connections) page
    2. Click **Connect** on **TikTok**
    3. Select the **Custom App (White-label)** tab
    4. Enter a **Connection Name** (for example "Acme Agency TikTok")
    5. Paste your **Client Key**, **Client Secret**, and **Refresh Token**
    6. Click **Verify & Connect**

    Markifact refreshes the token once with your client key and secret. Nothing is saved unless TikTok accepts all three values; the rotated refresh token TikTok returns is what gets stored.
  </Step>
</Steps>

***

## Selecting Your Connection

Custom app connections appear under the name you chose, with a **Custom app** badge on the Connections page. Select them in TikTok nodes, agents, and MCP exactly like any other TikTok connection. The connection name is also the account name shown in report rows.

***

## Rotating or Replacing the Token

Add the connection again with the **same connection name** and the new values. Markifact replaces the stored credentials in place, so workflows and agents bound to the connection keep working.

***

## Troubleshooting

<Accordion title="TikTok rejected the client key or client secret (invalid_client)">
  Check both values on your app's page in the TikTok for Developers portal. Resetting the secret invalidates the old one.
</Accordion>

<Accordion title="TikTok rejected the refresh token (invalid_grant)">
  The most common causes:

  * The token was issued by a different app than the one whose client key you pasted
  * The token has already been rotated: refresh tokens are single-use, so paste the newest one your system holds
  * The token expired (365 days) or the account holder revoked the app under TikTok **Settings** > **Security** > **Connected apps**

  Run the authorization again and paste the new refresh token.
</Accordion>

<Accordion title="TikTok returned no open_id for this token">
  The token was issued without the `user.info.basic` scope. Include it when authorizing and exchange a new code.
</Accordion>

<Accordion title="A node fails with a permission error after connecting">
  The token is missing one of the scopes in the table above, or TikTok has not approved that scope for your app yet. Check the scopes and the review status in the portal, then authorize again and paste the new refresh token.
</Accordion>

***

## Summary

| Item              | Where to Find                           | What It Looks Like |
| ----------------- | --------------------------------------- | ------------------ |
| **Client Key**    | TikTok for Developers portal > your app | `aw1234567890abcd` |
| **Client Secret** | Same page                               | `a1b2c3...`        |
| **Refresh Token** | Response of the auth code exchange      | `rft.abc...`       |

***

## Related

<CardGroup cols={2}>
  <Card title="White-label Connections" icon="tag" href="/core-concepts/white-label-connections">
    Overview of custom app connections across channels
  </Card>

  <Card title="Publish Post" icon="paper-plane" href="/nodes/tiktok/tiktok_publish_post">
    Publish videos and photos to a TikTok account
  </Card>
</CardGroup>