The TikTok Content Posting API: why your first post is private

Your integration works. The API returned 200, TikTok gave you a publish ID, the status polls came back PUBLISH_COMPLETE. And nobody can see the video.

That is not a bug in your code. It is TikTok's Content Posting API behaving exactly as documented for an API client that has not been audited yet — and it is the single most common way a TikTok integration surprises the team that built it, usually in the week it was supposed to ship.

Here is what the audit gate actually is, what you can and cannot do before you pass it, and how to design around it rather than discover it.

The short version

TikTok's Content Sharing Guidelines impose three restrictions on unaudited API clients:

Unaudited API Clients can only post contents in SELF_ONLY viewership.

Unaudited API Clients can allow up to 5 users to post in a 24 hour window.

All user accounts using the API client to post must be set to private at the time of posting.

Read those together and the shape of the problem is clear. Before the audit, you have a working integration that can serve five creators a day, publishing videos only the creator can see, from accounts that must be set to private. That is a demo, not a product. It is enough to prove your flow works and enough to record the demo video the audit asks for — which is precisely what TikTok designed it for.

Two posting modes, and the choice matters more than it looks

TikTok exposes two fundamentally different ways to get a video onto the platform, and they have different consequences for your product and your users.

The inbox path — TikTok's /v2/post/publish/inbox/video/init/ endpoint — hands the media to the creator and lets them finish the post inside TikTok. Nothing is published without them. That is why it is not gated behind the audit.

The Direct Post path publishes straight to the profile with the metadata you supply, and requires the video.publish scope. This is what most people mean when they say "post to TikTok via API," and it is the one behind the gate. Photos use a separate initialisation endpoint, /v2/post/publish/content/init/, rather than the video inbox endpoint.

If your product is a scheduler, you want Direct Post. If your product is a content tool that hands finished assets to creators, the inbox path may be all you ever need — and it ships today, with no audit and no creator cap.

The design decision most teams get backwards

The instinct is to build Direct Post first because it is the "real" integration, then apply for the audit at the end. That ordering costs you weeks.

The audit is calibrated on what you demonstrate, so you need a working, compliant UI *before* you apply. Meanwhile every day spent waiting is a day your product cannot onboard a sixth creator. The better ordering:

1. Ship the inbox path first if your use case tolerates it. It has no gate, no cap, and no privacy restriction. Real users can use it while you wait.
2. Build the Direct Post UI to TikTok's checklist — not to your own design taste. The audit is largely a UI review.
3. Apply early, with honest numbers.
4. Treat Direct Post as a capability that switches on, not as a launch dependency.

That last point is the practical one. Model the two modes as one code path with a flag, so passing the audit is a configuration change rather than a rewrite.

What the audit actually checks

It is not a security review and it is not about your infrastructure. It is a review of the experience you present to the creator, and it is largely conducted from a screen recording you supply.

You will be asked for:

• An app in production with video.publish enabled, consistent branding across your app name, website and redirect URI, and live HTTPS legal pages.
• A written application describing your product, your users, where content comes from, and how many creators you expect to publish per day. Answer that last one honestly — TikTok calibrates your post-audit creator cap from your own estimate. Understate it and you will be back in the queue.
• A demo video, typically 3–5 minutes, as one continuous screen recording of the whole flow — not an edited montage.
• UI compliance, checked point by point: that you display creator info fetched from TikTok before posting, that you surface the disclosure toggles for branded content and your own brand promotion, that you link TikTok's policies, and that the creator sees a preview and consents before anything publishes.

Passing lifts the SELF_ONLY restriction and raises the creator cap to a number derived from the usage estimates in your application. It does not make the cap infinite.

The parts of the flow you have to build regardless

Whichever mode you use, TikTok's publishing flow is asynchronous and has more steps than the single POST most APIs make you think in:

1# 1. Query creator info. This is not optional - the audit checks that you
2#    display what it returns (nickname, avatar, privacy options, duration cap)
3#    before the creator confirms the post.
4
5# 2. Initialise the upload. TikTok returns an upload URL and a publish id.
6
7# 3. PUT the video bytes to the upload URL, in chunks for larger files.
8
9# 4. Poll the status endpoint until the publish reaches a terminal state.
10#    A 200 on step 2 does not mean the video is live.

Three things to design for up front:

• Privacy options are per-creator. The values you may send come from the creator info response, not from a constant in your code. A creator with a private account will not offer PUBLIC_TO_EVERYONE.
• Disclosure toggles are compliance, not decoration. Branded content and "your brand" promotion have to be declared, and the combinations TikTok accepts are constrained.
• Publishing is eventually consistent. Build the status poll and a terminal-failure path before you build anything else, because that is where the real errors surface.

Where a unified API changes the calculus, and where it doesn't

Be clear about what a third-party publishing API can and cannot do for you here, because the honest answer is "less than you would hope on this specific platform."

What it removes: the upload orchestration, the chunking, the status polling, the token refresh, and the per-platform post shape. Through Outstand, TikTok posting is the same create_post call as every other network, with TikTok's specifics — postMode, privacyLevel, the disclosure toggles, disableComment, disableDuet, disableStitch — passed as an optional TikTok configuration object. The default mode is MEDIA_UPLOAD, which delivers to the creator's inbox as a draft and is not subject to the 24-hour cap on distinct publishing creators.

What it does not remove: the audit. TikTok's restrictions attach to the API client, and shared managed credentials carry the shared restrictions with them — SELF_ONLY posting and at most five distinct creators in a rolling 24 hours. If your product needs public Direct Post at scale, you register your own TikTok app and pass your own audit. There is no vendor who can hand you an exemption, and any who implies otherwise is describing their credentials, not yours. Outstand publishes the full audit checklist for exactly this reason.

That pattern is worth internalising because it recurs. LinkedIn gates Company Page posting behind Community Management API approval; Reddit gates the Data API behind the Responsible Builder Policy; TikTok gates public Direct Post behind an audit. The unified API removes the plumbing across all of them. It does not remove the platform's opinion about whether you should be allowed to publish — see LinkedIn API pricing for the same story on a different platform.

FAQ

Is the TikTok Content Posting API free?

There is no fee for API access. The cost is the audit and the restrictions you operate under until you pass it.

Can I post publicly to TikTok via API without an audit?

No. Unaudited API clients can only post in SELF_ONLY viewership, per TikTok's Content Sharing Guidelines.

How many users can post through an unaudited TikTok API client?

Up to 5 users in a 24-hour window. All of those accounts must be set to private at the time of posting.

What is the difference between Direct Post and upload mode?

Direct Post publishes to the creator's profile with metadata you supply and requires the video.publish scope. Upload mode delivers the media to the creator's TikTok inbox as a draft, and the creator finishes and publishes it in the app.

How do I get a TikTok API key?

Register an app in the TikTok for Developers portal, enable the Content Posting API products you need, and set your redirect URI. Registration gives you credentials; it does not give you unrestricted publishing — that is what the audit is for.

Does passing the audit remove all limits?

No. It lifts the SELF_ONLY restriction and raises the creator cap to a figure based on the usage estimates in your application.

*Last verified: September 2026, against TikTok's Content Sharing Guidelines and Content Posting API documentation at developers.tiktok.com, and Outstand's own TikTok audit guide. TikTok revises these requirements periodically — check the guidelines against the date on this post before you plan a launch around them.*