Connecting TikTok to AutoPost

Contents

0. Cover & contents

1. At a glance

2. Key terms

3. Step A — Setting your TikTok account to Private

4. Step B — Connecting in AutoPost

5. Step C — Filling in the TikTok panel in New post

6. Step D — Sending, scheduling, and checking the result

7. What you can't do with TikTok yet

8. Managing connected accounts

9. Troubleshooting

10. Frequently asked questions

11. Security and privacy

12. User checklist

13. Administrator A — Developer account and organization

14. Administrator B — Creating the AutoPost PT SKK app

15. Administrator C — Verifying the domain

16. Administrator D — Setting up the sandbox

17. Administrator E — Adding target users

18. Administrator F — Pasting the keys into Vercel

19. Administrator G — The road to audit

20. Administrator checklist

1. At a glance

What you'll achieve

After following this guide, AutoPost can send a video or a photo to your TikTok account: right away when you press Send now, or automatically at the time you schedule.

It works through TikTok's official permission with AutoPost's own TikTok app. You don't create an app, you don't enter any keys, and you never give your TikTok password to AutoPost. You just approve the permission once on a TikTok page.

Who does what

This guide is written for two readers.

Users only need chapters 1–12. Chapters 13–20 explain the behind-the-scenes work that makes the Connect TikTok button usable.

AutoPost and TikTok status (29 September 2026)

We're being upfront so there are no surprises.

• AutoPost's TikTok app (AutoPost PT SKK) is registered and runs in Sandbox mode — TikTok's test mode.

• Its production version hasn't been reviewed or audited by TikTok yet. It hasn't been submitted (chapter 19).

• On 29 September 2026 the full flow was tried for real on production AutoPost: the account connected, then one photo and one 6-second video went live on the TikTok profile — as private posts.

While this lasts, TikTok's documentation says these limits apply:

What we've seen ourselves is only the success path with one Private target-user account. Rejection of a public account, of an account that isn't a target user, and the 5-user limit have never been triggered by us; we wrote all three from TikTok's documentation.

The Social accounts › TikTok page and the TikTok panel in New post show a similar audit status note. This guide will be updated as soon as the TikTok audit passes.

Estimated time

What you need

What AutoPost sends to TikTok

AutoPost doesn't add any watermark, logo, or promotional text to your videos or photos.

Not supported by AutoPost yet: posts with several photos at once (carousel — if the media list holds more than one item and the TikTok account is ticked, every save path is held), adding music from TikTok, drafts to the TikTok inbox, and editing or deleting posts that are already live. Deleting is done directly in the TikTok app.

2. Key terms

3. Step A — Setting your TikTok account to Private

According to TikTok's documentation, until AutoPost passes TikTok's audit, TikTok rejects posts from AutoPost to public accounts. Set the account to Private first — before connecting and before every post. Pick one of the methods.

3.1 On tiktok.com (we tried this)

1. Open tiktok.com, sign in, then open your Profile.

2. Press the gear button (settings) in the row with the Edit profile and Promote post buttons. The settings page opens.

3. In the Privacy section, under Discoverability, turn on Private account.

TikTok's note under the switch: with a private account, only users you approve can follow you and watch your videos; your existing followers aren't affected. On one of our test accounts, the Comments setting (who can comment) was set to Followers after the account was made private.

3.2 In the TikTok app on your phone

We haven't captured the steps in the phone app; the menu names can differ slightly depending on the app version and your phone's language. If in doubt, use method 3.1.

1. Open the TikTok app, then open your Profile.

2. Tap the menu (three lines) at the top right, then Settings and privacy.

3. Choose Privacy.

4. Turn on Private account.

3.3 How to tell the account is Private

On your tiktok.com profile, a private account shows a padlock icon next to the name (see the image in 6.5). According to TikTok's documentation, the Everyone privacy option is only offered for public accounts — so if the TikTok panel in AutoPost still offers it, TikTok still considers your account public (5.4).

4. Step B — Connecting in AutoPost

4.1 Opening the TikTok page

1. In your browser, open tiktok.com and sign in with the TikTok account you want to use.

2. In AutoPost, open the Social accounts menu. On the TikTok card, press Connect (it reads Manage if an account is already connected). The TikTok page opens.

That page has a yellow-bordered box TikTok is still awaiting audit (a summary of the limits in chapter 1: private posts, the account must be Private, at most 5 users per day), a How to connect card with four numbered steps, and the Connected accounts card on the right.

4.2 Pressing Connect TikTok

1. Make sure your TikTok account is already Private (Step A).

2. Press the gold Connect TikTok button in the How to connect card.

3. The browser moves to TikTok's permission page. Finish within 10 minutes.

4.3 Approving the permission on the TikTok page

TikTok shows a permission page in English: "AutoPost PT SKK (Sandbox) wants to access your TikTok account".

Press Continue. Above the button, TikTok notes that by continuing you agree to the AutoPost app's Terms of Service and have read its Privacy Policy, and that you can always see or remove this access in the TikTok app.

We've only tried pressing Continue. Pressing Cancel or turning off Post content to TikTok hasn't been tried for real; the messages in the table above and in 9.1 come from AutoPost.

4.4 What AutoPost does behind the scenes

1. When Connect TikTok is pressed, AutoPost creates a random security code (state) and stores it encrypted in a browser cookie that lasts 10 minutes.

2. After you press Continue, TikTok sends you back to AutoPost's return address. AutoPost checks that the security code matches, that you're still signed in with the same AutoPost account, and that the posting permission was really granted.

3. AutoPost exchanges the authorization code for an access token (24 hours) and a refresh token (365 days).

4. AutoPost reads your TikTok profile (display name, username, profile photo).

5. The tokens are stored encrypted (AES-256-GCM) in the database. The temporary cookie is deleted.

6. The access token is renewed automatically by the AutoPost worker when less than 6 hours remain. TikTok may issue a new refresh token each time it's renewed; AutoPost always saves it.

4.5 Signs of success

You return to the TikTok page in AutoPost. A green box appears at the top:

On the right of the page, your account appears in the Connected accounts card (counter "1 of 3") with a green connected label, the display name and permission period (for example "Rina Kusuma · permission valid until Sep 29, 2027 (renewed automatically)"), when it was connected, a Retest button, and a red Disconnect button.

4.6 Reconnecting without the permission page

If you connect the same account again while its permission is still valid, TikTok may send you straight back without showing the permission page. A green banner reads:

The account isn't recorded twice; only its token is replaced.

4.7 What "1 of 3" means

Each AutoPost account can connect at most 3 TikTok accounts. The database enforces this limit. Once you have 3, the text next to the button reads "Already 3 accounts: this button can only reconnect the same account. Disconnect one account to add a new one." A fourth account is rejected with the message "There are already 3 TikTok accounts. Disconnect one first if you want to replace it."

5. Step C — Filling in the TikTok panel in New post

5.1 Quick rules before you write

• Media is required: a video or one JPEG/WebP photo. Text only or a PNG photo can't be sent.

• Media must be uploaded to AutoPost via Upload from gallery (max. 50 MB per file). For video, Upload from gallery accepts MP4 and MOV; TikTok does accept WebM, but it can't be uploaded here yet.

• According to TikTok's documentation:

  • Video: 3 seconds to 10 minutes (and no longer than your own account's limit), up to 4 GB, 23–60 fps, sides 360–4096 px.

  • Photo: JPEG or WebP, up to 20 MB, at most 1080p.

• Text: a video caption can be up to 2,200 characters; for a photo, the first line becomes the title (max. 90 characters) and the whole text becomes the description (max. 4,000 characters). An emoji counts as two.

• According to TikTok's documentation, about 15 posts per day per TikTok account (this allowance is shared with every app you use).

• Each post is chosen individually: privacy, comment/duet/stitch permissions, and commercial content disclosure — there are no defaults.

5.2 Ticking the TikTok account

1. Open New post and write your text.

2. Press Upload from gallery and choose a video or photo.

3. In the Send to section, tap the TikTok account until it's ticked (dark blue with a ✓).

As soon as the TikTok account is ticked, the TikTok panel appears right below Send to.

5.3 The panel header: account name and Reload

Every time the panel appears, AutoPost asks TikTok for your account info (TikTok's guidelines require this every time). While it waits, it shows "Reading TikTok account info…". Then the panel header shows your profile photo, Send to TikTok · @rina.kusuma, and your TikTok display name.

The Reload button reads that info once more — use it if you've just changed your account settings in the TikTok app (for example, just set it to Private).

Below it there's always a yellow audit status note: "AutoPost is still awaiting TikTok's audit. Until it passes, posts are visible only to you (private) whatever privacy you choose, your TikTok account must be set to Private, and at most 5 AutoPost users can post to TikTok per day."

If TikTok refuses to give the info (for example, the daily posting limit is reached, or the permission needs renewing), the panel shows a red box "TikTok can't accept posts from this account right now" with the reason, and the send button is held. What each reason means is in 9.3.

5.4 Who can view this post (privacy)

Choose one option from the Who can view this post list. This choice is required and has no default — the box starts at "Choose privacy…".

The options come from TikTok and follow your account settings, so they may differ from the table above.

5.5 Allow other users: photos and videos differ

All checkboxes in the Allow other users section are unticked at first. Tick the ones you want.

Options turned off in your TikTok account settings appear grayed out with the note "turned off in your TikTok account settings" and can't be ticked. In our test with a Private account, Duet and Stitch were grayed out like this.

5.6 Disclose commercial content

Turn on the Disclose commercial content switch if this post promotes yourself, a brand, a product, or a service — including when someone else pays you. The switch is off at first. Once it's on, two options appear:

The rules:

• While the switch is on, at least one option must be ticked. If not, red text says: "Choose Your brand, Branded content, or both — or turn off Disclose commercial content." and the send button is held.

• Branded content can't be "Only me". The Only me option in the privacy list changes to "Only me (not available for branded content)". If you already chose Only me and then tick Branded content, the privacy is cleared with the message "Only me was cleared because branded content can't be private. Choose privacy again."

• Turning the switch off clears both ticks.

5.7 AI-generated content

Tick AI-generated content if this video or photo was created or heavily edited with AI. TikTok adds the label "AI-generated". This checkbox is also off at first. TikTok's documentation mentions this label for videos; for photos, AutoPost still passes the tick along, but we haven't confirmed that the label appears.

5.8 Preview for TikTok

At the bottom of the panel, Preview for TikTok shows your video or photo in a vertical 9:16 frame.

• Video: AutoPost reads the duration first ("Checking video duration…"), then shows, for example, "Duration 6 seconds · this account's limit is 600 seconds" (the limit comes from TikTok for your account; 600 here is just an example). A video longer than your account's limit or shorter than 3 seconds is marked red and the send button is held.

• If the duration can't be read, the button is also held with the message "The video duration couldn't be read, so AutoPost can't confirm this video is within your TikTok account's limit. …" — upload the video again (MP4 or MOV).

• If the media is an address from another site, a red warning appears: "This media comes from another site. TikTok only accepts media uploaded to AutoPost — use Upload from gallery so your TikTok post doesn't fail."

• A permanent note: "After sending, TikTok processes the post for a few minutes (sometimes longer). Its final status appears on the Posts page."

5.9 The consent sentence above the send button

While the TikTok account is ticked, TikTok's consent sentence appears right above the send button:

If Branded content (paid partnership) is ticked, the sentence becomes: "By posting, you agree to TikTok's Branded Content Policy and Music Usage Confirmation." Both names are links to TikTok's official pages (they open in a new tab).

Pressing the send button means you agree. AutoPost records the time of that consent with the post.

5.10 Limits per platform

The Limits per platform card on the right counts the text for TikTok:

The small note under that row may read:

• "The Link field is added at the end of the TikTok text and counted."

• "The first line becomes the TikTok photo title and is cut to 90 characters; the full text still goes into the description."

• "More than 2200 characters is rejected by TikTok — shorten it or deselect the TikTok account." (for photos: 4000)

5.11 When the button is held

While the panel is incomplete, every save path is held — including Save draft. A red box appears above the button, for example:

(The opening becomes "Schedule is on hold:" or "Save draft is on hold:" depending on your choice.)

Without a video or photo, a red box appears:

A PNG or GIF photo is held with "TikTok only accepts JPEG or WebP photos — TikTok rejects PNG and GIF photos. Convert the photo to JPEG, use a video, or remove the TikTok account."

6. Step D — Sending, scheduling, and checking the result

6.1 Send now

1. Choose Send now (next to Save as draft and Schedule).

2. Read the consent sentence, then press the gold Send now button.

Because TikTok is still processing, a green message appears:

Below the button, AutoPost also reminds you:

That "Not sent yet" message isn't a failure. AutoPost has already handed the post to TikTok; TikTok is fetching the media from AutoPost and processing it. Don't send the same post again — that would create a second post.

6.2 From "processing" to "sent"

Open the Posts menu. While TikTok is processing, that post card:

• has a blue clock icon and a blue pill labeled processing — not "failed";

• shows a purple pill "1 retrying automatically ± time" — the time is the estimate of the next check, for example "1 retrying automatically ± 22:14";

• has no Resend failed button — on purpose, so the post isn't sent twice;

• opens Details per account with the status retrying and the message "TikTok is fetching and processing the media (usually a few minutes). We'll check again shortly." or "TikTok is still processing the post. We'll check again shortly."

The processing label is used while no account has failed or been sent and the rest are still waiting. Because of that, this card also shows up in the Failed tab, still labeled processing. If the same post was already sent to another platform, the card is labeled partial with the same purple pill.

AutoPost checks the status on TikTok in the next worker round (30 seconds later at the earliest; the worker runs about every minute), for up to 60 minutes, without using up retry attempts and without ever resending to TikTok. The Posts page doesn't refresh itself — reload the page to see the latest status. In our test on 29 September 2026, the status changed to sent about 1 minute later.

A post with the Only me privacy gets a note in Details per account: sent · note — "Published on TikTok (private while the app isn't audited)".

6.3 Schedule

1. Choose Schedule, then fill in the date and time (WIB).

2. Check the consent sentence, then press Schedule post. "Post scheduled." appears.

Your TikTok panel choices and the time of your consent are saved with the schedule. The AutoPost worker sends it by itself at the right time, then checks its status as in 6.2. Before sending, AutoPost asks TikTok for the account info once more: if your privacy choice is no longer available (for example, the account switched between public and private), that post fails with the message "The privacy option is no longer available for this TikTok account …" (9.4) and isn't retried.

We haven't really tested scheduling to TikTok; only Send now has been proven. It uses the same worker path that sends schedules to other platforms.

6.4 Save draft

A draft with a TikTok account saves the media, the text, and all the panel choices. In the Posts menu, that draft has a Send now button; TikTok's consent sentence appears again right above that button (6.6).

6.5 Seeing the result on your TikTok profile

Open your profile in the TikTok app or on tiktok.com. Posts from AutoPost appear in the Videos tab with a padlock icon in the bottom-right corner — a sign that the post is private. Your account name also has a padlock icon because the account is Private. Photo posts are marked with a photo icon in the top-right corner.

In our test on 29 September 2026, the photo was sent first and reached sent at 22:08 WIB (image below), then the 6-second video was sent afterwards and reached sent at 22:13 WIB (image above).

6.6 Resending from the Posts page

A failed post has a Resend failed button in the Posts menu (drafts and schedules: Send now). A post labeled processing (6.2) deliberately has no such button — wait for the result. If the post has a TikTok target that hasn't been sent, TikTok's consent sentence appears again right above the button — TikTok requires consent every time you post. The panel choices used are the ones saved when the post was created.

Before pressing Resend failed, read the reason in Details per account (section 9.4) and fix the cause first — for example, set the account to Private. If the reason says "Check your TikTok profile … so it isn't posted twice", open your TikTok profile first.

7. What you can't do with TikTok yet

8. Managing connected accounts

8.1 Retest

The Retest button in the Connected accounts card opens the token, renews it if less than 6 hours remain, then reads your profile and account info on TikTok again. If all is well, a yellow banner appears:

• "Retest finished — the account is still healthy and ready to send."

• "Retest finished — the account is healthy and we extended its token too."

If TikTok is busy (rate limit, network, a brief outage), the account status is not changed; the message ends with "We didn't change the account status — try testing again shortly." If the permission has expired or been revoked, the account is labeled needs reconnecting. Other errors give the label has a problem. The cause appears in red under the account name.

Retest also updates the name and profile photo if you changed them on TikTok.

8.2 Reconnecting

Press Connect TikTok again and approve the permission with the same TikTok account. AutoPost refreshes the token (it doesn't create a new account), and scheduled posts keep working. If the permission is still valid, TikTok may send you straight back without the permission page (4.6).

Reconnect when:

• the account is labeled needs reconnecting;

• you revoked AutoPost's permission in the TikTok app and want to use it again;

• the 365-day permission period is almost over (the account card says "The TikTok permission is about to expire. Reconnect this account.").

8.3 Disconnect

The Disconnect button removes the account from AutoPost and revokes AutoPost's permission on TikTok. AutoPost asks "Disconnect this account? AutoPost's permission on TikTok is revoked and its token deleted."; press Yes, disconnect to continue. The result: "Account disconnected — its row and token are gone from the database."

If TikTok won't revoke the permission (for example, the network drops or the token is already dead), an extra yellow box appears:

Disconnect also removes that account from scheduled posts aimed at it, and the old send records for that account in Details per account disappear too. If you only want to refresh the token, don't disconnect — reconnect (8.2).

We haven't run Disconnect for a TikTok account for real; the order and messages above follow AutoPost.

8.4 Revoking the permission in the TikTok app

TikTok's permission page notes that you can always see or remove an app's access in the TikTok app. Look for the app permissions section in Settings and privacy, then remove AutoPost PT SKK (during the test period it may read AutoPost PT SKK (Sandbox)). We haven't captured the exact menu name. After that, according to AutoPost, the next post fails with the message "AutoPost's TikTok permission is no longer valid (revoked or expired). Reconnect this account." and the account is labeled needs reconnecting. Disconnect that account in AutoPost if you don't want to use it again.

8.5 Adding a 2nd and 3rd account

1. While in Sandbox mode, the next account must first be registered by the administrator as a target user (chapter 17).

2. Set that account to Private.

3. In the browser, sign out of the first TikTok account and sign in with the next one (or use Switch account on the permission page).

4. Press Connect TikTok and approve the permission.

At most 3 TikTok accounts. We haven't tried this with a second account; the flow is the same as for the first.

9. Troubleshooting

All AutoPost messages below are copied exactly from AutoPost. On the TikTok page, messages start with "Failed:"; in Details per account, a message that will be retried gets the suffix "(retrying automatically, attempt N of 4)" — except the "still processing" messages (9.4), which don't use up retry attempts. Parts that vary are marked "…" or "N".

As of 29 September 2026, we've only seen the success path ourselves (connecting, photo and video with the Only me privacy, the "Not sent yet" banner, the sent status, Retest, and reconnecting). We've never triggered the error messages in this chapter for real; their causes and fixes are written from AutoPost's code and TikTok's documentation.

9.1 When pressing "Connect TikTok" or returning from TikTok

9.2 During Retest, Disconnect, or in the account status

9.3 In the TikTok panel and when saving

The red box "TikTok can't accept posts from this account right now" in the panel is followed by one of these reasons:

The red box "… is on hold:" above the send button (and the message when the button is pressed):

Server messages when saving (rare, because the composer already holds these first):

9.4 When sending or after scheduling

These messages appear in Details per account on the post card in the Posts menu.

Still processing — not an error:

Needs your action:

Retrying automatically — just wait:

Messages for the administrator (nothing wrong with your post — report them to the administrator):

9.5 Problems that don't show an AutoPost message

10. Frequently asked questions

Do I have to create my own TikTok app?No. The TikTok app belongs to AutoPost. You just press Connect TikTok and press Continue on the permission page.

Why are my posts visible only to me?Because AutoPost hasn't passed TikTok's audit yet. According to TikTok's documentation, until the audit passes, all posts from AutoPost are restricted to private mode. This is TikTok's rule, not an AutoPost setting.

After the audit passes, do old posts become public automatically?According to reports from other developers (not TikTok's official documentation), no. You'll need to switch the account to public and then change the privacy of each post manually in the TikTok app.

Why can't my friend's account be connected yet?In Sandbox mode, only accounts registered by the AutoPost administrator as target users can grant permission (according to TikTok's documentation, at most 10 per sandbox). Ask the administrator to register it (chapter 17).

Can I choose "Followers" or "Friends"?Yes, if they're offered, but according to TikTok's documentation the result is still private during the audit period. We haven't tested those options; our test used Only me.

How long until a post goes live?In our test, about 1 minute after Send now. According to TikTok's documentation, processing time depends on the video size and isn't guaranteed; AutoPost waits up to 60 minutes (6.2).

Does AutoPost add music or a watermark?Neither. The "Music Usage Confirmation" sentence still has to be accepted because TikTok's rule applies to every post.

Can I post several photos at once?Not to TikTok yet. AutoPost sends one video or one photo per post to TikTok. Posts with several media items can still go to Telegram, Facebook Page, Instagram, and Threads — untick the TikTok account for that post.

Can I use the AutoPost Android app?Not yet. TikTok posts are composed and scheduled from the AutoPost web app, because the TikTok panel only exists there.

Why isn't TikTok available in Auto post?Under TikTok's guidelines, content from other websites must not be posted automatically, and you must approve every post yourself (chapter 7).

Do I need to reconnect every day?No. The access token (24 hours) is renewed automatically. You only need to reconnect if the permission is revoked or the permission period (365 days, according to TikTok's documentation) runs out.

How do I delete a post that's already live?In the TikTok app. Deleting it in AutoPost only deletes the record in AutoPost.

11. Security and privacy

11.1 What AutoPost stores

11.2 What never happens

• AutoPost never asks for or sees your TikTok password.

• AutoPost doesn't post anything unless you press Send now, Schedule post, or Resend failed.

• AutoPost doesn't read the videos, followers, or messages on your TikTok account — it only has two permissions.

11.3 How TikTok fetches your media

TikTok pulls the video or photo directly from AutoPost's own address (a domain the administrator verified with TikTok), through a signed link that's valid for only 2 hours and only for that post's file. Your media is never moved to another service.

11.4 Stopping using TikTok in AutoPost

1. Press Disconnect on the TikTok account (8.3). AutoPost's permission on TikTok is revoked too.

2. If the box "AutoPost's permission on TikTok couldn't be revoked automatically" appears, revoke it yourself in the TikTok app (8.4).

12. User checklist

• The TikTok account is set to Private.

• While in Sandbox mode: the account is registered by the administrator as a target user.

• Signed in to tiktok.com in the same browser as AutoPost.

• Social accounts › TikTok › Connect TikTok → Continue on the permission page, without turning off Post content to TikTok.

• The green message "… was connected after testing it with TikTok" and the connected label in Connected accounts.

• New post: a video or JPEG/WebP photo uploaded, the TikTok account ticked.

• TikTok panel: privacy chosen, interaction permissions and content disclosure checked, AI label if needed.

• Consent sentence read, then Send now (or Schedule).

• Posts menu: the processing label changes to sent (reload the page; don't press Send again).

• TikTok profile: the post appears with a padlock icon.

13. Administrator A — Developer account and organization

Chapters 13–20 are only for the AutoPost administrator (PT SKK). Regular users don't need to do any of this.

13.1 Developer account

The account at developers.tiktok.com is created with a company email address, not with a TikTok sign-in. After you sign up, TikTok sends a 6-digit code to that email address.

1. Open developers.tiktok.com and sign up with the email address (we didn't capture the sign-up screen).

2. On the Verify your email page, type the 6-digit code from the email, then press Next.

The administrator creates the account and signs in personally.

13.2 The Manage apps page

After signing in, the Manage apps page is still empty: "You do not have any apps yet. Connect an app to get started." The red Connect an app button is at the top right of the page (outside the cropped image).

13.3 Why an organization

When you press Connect an app, the Create app window asks for the app owner (Ownership): Individual or Organization. Choose Organization — according to TikTok's documentation, an organization is strongly recommended and its name is shown to users.

If you don't have an organization yet, the Select organization list only contains "No organizations". Close that window and create the organization first.

13.4 Creating the organization

1. Open My organizations (from the account menu), then press Create an organization.

2. Fill in Organization name with the full legal name of the company: PT Solusi Kecerdasan Komputasi.

3. Press Create.

The organization page opens with the tabs Overview, Roles and access, Compliance, and Settings. The Overview section shows the Org ID and your role, Owner. Below that, the Apps box still says "No apps yet" with a Create app button — only this part appears in the image.

14. Administrator B — Creating the AutoPost PT SKK app

14.1 Create app

1. On the organization page, press Create app.

2. Fill in App name. This name is shown to TikTok users.

3. Under App type, choose Other ("Login with TikTok, Share Kit, Content Posting API, or others"). Don't choose Mini game or Mini drama. The app type can't be changed later.

4. Press Create app.

14.2 The app name must be unique

The name AutoPost is already used by another app on TikTok. When Create app is pressed, the message "App name is already taken. Try another one." appears. That's why the AutoPost app is named AutoPost PT SKK.

This is the name users see on the permission page, with the suffix (Sandbox) while in test mode (4.3).

14.3 The app page: Production and Sandbox

The app opens with two tabs next to its name: Production and Sandbox. On the Production tab, the status on the left is Draft; the left menu contains App details, App review, Products, Scopes, and Roles & Access. At the top right are URL properties, Save, and Submit for review. (The left side of the Production · Draft tab is shown in the image in 19.1.)

In App details, the Credentials card holds the Client key and the Client secret (hidden). Both are used in chapter 18.

14.4 Filling in App details

The following three addresses must be verified (chapter 15):

Once all three addresses are filled in, each is marked in red "This URL is not verified. Verify URL properties" and the top bar says "This form has 3 errors." (the image above shows the first two). That's expected — verification is in chapter 15.

15. Administrator C — Verifying the domain

TikTok only accepts addresses that are proven to be yours. One verification of the parent domain solusikecerdasankomputasi.com covers both app-autopost. (terms, privacy, return address, and media proxy) and autopost. (the official site).

15.1 Choosing the property type

1. Press Verify URL properties (or URL properties at the top right of the app page).

2. Under Select property type, choose Domain — "Verification method: DNS record". According to TikTok, a verified domain covers every URL under the domain and its subdomains.

3. Enter the parent domain solusikecerdasankomputasi.com (we didn't capture this input screen; the result is shown in 15.2).

15.2 Copying the TXT value from TikTok

The Verify Domain window shows two steps:

1. "Copy the text below and save it as the DNS TXT record for solusikecerdasankomputasi.com" — press Copy. The value starts with tiktok-developers-site-verification=.

2. "Click Verify" — with a note that DNS changes can take a few hours.

Don't press Verify yet. Add the DNS record first (15.3).

15.3 Adding the TXT record on Cloudflare

1. Sign in to Cloudflare, open the domain solusikecerdasankomputasi.com → DNS → Records → Add record.

2. Fill in:

3. Above the fields, Cloudflare summarizes the record it will create ("… has a record with content …"). Press Save.

15.4 Pressing Verify

Go back to the Verify Domain window on TikTok and press Verify. If it works, "Your property has been verified" appears with the row Domain solusikecerdasankomputasi.com — Verified. Press Ok. The "This URL is not verified" messages in App details disappear.

If it fails, wait (according to TikTok, DNS changes can take a few hours), then press Verify again.

To check it at any time, press URL properties at the top right of the app page. The URL properties for Production window lists solusikecerdasankomputasi.com (type Domain) under Verified properties.

16. Administrator D — Setting up the sandbox

An app that TikTok has never approved must be tested and demoed from a sandbox. The AutoPost that currently runs in production uses this sandbox's keys (chapter 18).

16.1 Creating the sandbox

1. On the app page, open the Sandbox tab. It shows "Welcome to Sandbox mode — Try out integrations in a restricted environment."

2. Press Create Sandbox.

3. Fill in Sandbox name, for example AutoPost Uji. The "Clone from Production or an existing Sandbox" box can be left unticked.

4. Press Confirm.

The sandbox page opens with the text "You are editing AutoPost Uji, a Sandbox version of AutoPost PT SKK". The sandbox has its own Client key and Client secret, different from Production's. Its left menu: App details, Products, Scopes, and Sandbox settings (the last one is outside the cropped image; it's used in chapter 17). Changes are saved with the red Apply changes button at the top right (16.7).

16.2 Filling in the sandbox App details

Fill in the sandbox's App details the same way as production (14.4): icon, name, terms, privacy, the Web platform, and the Web/Desktop URL. The top bar says "This form has unsaved changes" until Apply changes is pressed.

16.3 Adding Login Kit and Content Posting API

1. In the Products section, press + Add products.

2. On the Login Kit card, press + Add.

3. On the Content Posting API card ("Share videos from your app either as a draft or a direct post to TikTok."), press + Add. This product requires Login Kit, so its button only becomes active after step 2.

4. Each product you add shows a notification ("Login Kit added.", "Content Posting API added.") and its card is marked Added. Press Done at the bottom of the window (outside the cropped image).

Other products (Share Kit, Webhooks, Data Portability API, and so on) do not need to be added.

16.4 Filling in the Redirect URI

On the Login Kit card, in the Redirect URI section ("Add up to 10 Redirect URIs…"), Web tab, enter:

https://app-autopost.solusikecerdasankomputasi.com/api/sosial/tiktok/kembali

16.5 Turning on Direct Post and verifying the sandbox domain

On the Content Posting API card:

1. TikTok notes that Upload to TikTok (drafts the creator finishes) is enabled by default. AutoPost doesn't use it.

2. Turn on the Direct Post switch — "Directly post content to authorized users' profiles."

3. On the Verify domains row, press Verify. TikTok explains that content can be sent with push_by_file or pull_by_url, and that pull_by_url requires a verified domain. AutoPost uses pull_by_url: TikTok pulls the media from AutoPost's own address.

4. Verify the domain solusikecerdasankomputasi.com for the sandbox the same way as in chapter 15. The production verification does not automatically apply to the sandbox.

16.6 Scopes

In the Scopes section, make sure these three rows are present:

AutoPost only requests user.info.basic and video.publish when a user connects — that's why the permission page shows only two switches (4.3). video.upload shows up in the sandbox list by itself, but it's neither requested nor used.

16.7 Apply changes

Press Apply changes. A Saved notification appears at the top.

17. Administrator E — Adding target users

While in sandbox mode, only target users can connect the app. Every AutoPost user who wants to try TikTok now must be registered here (according to TikTok's documentation: at most 10 per sandbox, and a new account can take up to 1 hour before it takes effect).

1. In the sandbox's left menu, open Sandbox settings → Target Users: "Try out your Sandbox with an authorized target account".

2. Press Add account.

3. The Connect TikTok account window explains that you'll be redirected to sign in to a TikTok account. Press Continue, then sign in with the TikTok account being registered and approve (according to TikTok's documentation, this includes accepting the Developer Terms of Service; we didn't capture this screen).

4. The account appears in the list with its TikTok username, Time added, and a Remove button.

18. Administrator F — Pasting the keys into Vercel

18.1 Copying the Client key and Client secret

The keys AutoPost uses now are the sandbox's (16.1), because the production app hasn't been approved yet.

1. Open the Sandbox tab → AutoPost Uji → App details → Credentials.

2. Reveal and copy the Client key, then the Client secret.

18.2 Setting the env variables in Vercel (administrator only)

1. Open the Vercel project autopost-web → Settings → Environment Variables (the Production environment).

2. Fill in:

3. Press Save, then redeploy so the new settings are picked up.

18.3 Checking the result

Open /akun/tiktok in AutoPost (while signed in):

• The The TikTok connection isn't open yet box is gone, and the Connect TikTok button is active.

• If the box is still there, open the Note for the AutoPost administrator fold. It lists the names of the env variables that are still empty (without their values).

Then test the user flow yourself (chapters 3–6) with a target-user account. On 29 September 2026 this test succeeded: the account connected, and the photo and video went live as private.

19. Administrator G — The road to audit

Up to chapter 18, AutoPost can be used by target users with private results. For every user to be able to post publicly, two more stages with TikTok remain. Neither has been done yet.

19.1 Preparing the production app

1. On the Production tab, fill in App details (chapter 14) and verify the domain (chapter 15) — already done for the terms, privacy, and site URLs.

2. Add the same products and settings as the sandbox: Login Kit + Redirect URI, Content Posting API + Direct Post + domain verification, the scopes user.info.basic and video.publish. According to TikTok's documentation, the sandbox configuration can be imported into the production Draft with Import.

3. Upload the App icon on the Production tab — as of 29 September 2026 its box is still empty — and make sure Category and the other required fields are filled in.

4. Only request scopes that are shown in the demo video. AutoPost doesn't use video.upload.

19.2 Recording the demo video (from the sandbox)

An app that has never been approved must use the sandbox for its demo. A suggested order (record with the AutoPost interface in English so the reviewers can follow every label):

1. Sign in to AutoPost at app-autopost.solusikecerdasankomputasi.com. According to TikTok's documentation, the domain in the video must match the app's Website URL — and AutoPost's Web/Desktop URL is autopost.solusikecerdasankomputasi.com (14.4), a different subdomain. Start the recording on that site and then sign in to the app, so both addresses are visible. We don't know yet whether reviewers accept this approach.

2. Social accounts → TikTok → Connect TikTok → TikTok's permission page shown in full (app name, two permissions) → Continue.

3. Back in AutoPost: the account is connected.

4. New post: upload a video → tick the TikTok account → the TikTok panel shows the creator name, privacy with no default, comment/duet/stitch permissions (unticked), commercial content disclosure (two options and the Only me restriction for branded content), AI-generated content, and the preview.

5. The consent sentence above the button → Send now.

6. The Posts page: the status goes from processing to sent.

7. The post appears on the TikTok profile.

Never show the Vercel pages, the Client secret, or tokens. Don't speed the video up.

19.3 Submitting the app review

1. On the Production tab, open App review. The first field asks how each product and scope works in AutoPost (at most 1,000 characters): how AutoPost uses Login Kit and Content Posting API, and why it needs user.info.basic and video.publish.

2. Press Upload and upload at least one demo video showing the end-to-end flow.

3. Press Submit for review. The status changes from Draft to In review; the result is Live or Not approved (with the reason in the history).

According to TikTok's documentation, the app review takes a few days to two weeks. Submitting this form is an action on behalf of the company — the administrator presses Submit for review personally.

19.4 Submitting the Direct Post audit

Once the app is Live, the Direct Post audit is submitted separately from the developer portal. According to reports from other developers (unofficial), the form includes: a description of the product and the integration, the estimated number of posts per day (the basis for TikTok's daily user quota), the UX steps, the reason for each scope, and a demo video. TikTok doesn't give a timeline for the audit.

19.5 After the app is Live and the audit passes

1. Copy the Client key and Client secret from the Production tab, paste them into Vercel replacing the sandbox keys (18.2), then redeploy.

2. Ask users who connected during the sandbox period to reconnect (8.2) — tokens from the sandbox app most likely don't work with the production app (we haven't tried this).

3. Test it yourself: send a post with the Everyone privacy from a public account, then open the profile from an incognito window.

4. Update the "awaiting audit" status text in the app (TikTok page, TikTok panel, landing page) and this guide.

20. Administrator checklist

• TikTok developer account created with a company email address, email verified. (Done, Sep 29, 2026.)

• Organization PT Solusi Kecerdasan Komputasi created (the name can't be changed). (Done, Sep 29, 2026.)

• App AutoPost PT SKK (type Other) created; terms, privacy, Web platform, and site filled in. (Done, Sep 29, 2026. The icon has only been uploaded in the sandbox; not yet on the Production tab — 19.1.)

• Domain solusikecerdasankomputasi.com verified via TXT on Cloudflare — production. (Done, Sep 29, 2026.)

• Sandbox AutoPost Uji: Login Kit + Redirect URI …/api/sosial/tiktok/kembali, Content Posting API + Direct Post, domain verified, scopes user.info.basic + video.publish, Apply changes. (Done, Sep 29, 2026.)

• A target user added for every test account. (One account, Sep 29, 2026.)

• TIKTOK_CLIENT_KEY and TIKTOK_CLIENT_SECRET (Sensitive) set personally in Vercel; APP_URL_PUBLIK checked; redeployed. (Done, sandbox keys.)

• /akun/tiktok: the The TikTok connection isn't open yet box is gone; the user flow tested until a post went live as private. (Done, Sep 29, 2026.)

• Production app completed (products, redirect, Direct Post, domain, scopes).

• Demo video recorded from the sandbox; Submit for review submitted.

• App Live; Direct Post audit submitted.

• Production keys in Vercel, redeployed, users reconnected, public posting proven.

• Status text in the app, landing page, and this guide updated.

Need help? Open the Help menu in AutoPost, or the New here? How to use this page box on the TikTok page.