How to Get a TikTok API Key: Client Key, Secret and Access

November 9, 2026

Short answer

To get a TikTok API key, sign up at developers.tiktok.com, go to Manage apps, click Connect an app, and copy the Client key and Client secret from the app's Credentials section. To use them, add a product such as Login Kit with the Display API, pick scopes like user.info.basic and video.list, and either test in a sandbox or submit the app for review. The Research API is a separate application for qualified academic and nonprofit researchers.

A TikTok API key is a pair: the Client key, which identifies your app, and the Client secret, which proves it. Neither one calls the API on its own. You trade them, plus a user's consent, for an access token. Which token you can get depends on the product your app is approved for, so pick the product first. For what the official APIs cost and allow, see Is the TikTok API free?

Display API vs Research API: which one you need

	Login Kit + Display API	Research API
Who can use it	Any developer whose app passes review	Qualified researchers at academic institutions in the US, EEA, UK, Canada or Switzerland; EU nonprofits in beta
Whose data	Only users who log in to your app	Public TikTok content, by query
Token	User access token (OAuth)	Client access token (client credentials)
Key scopes	`user.info.basic`, `video.list`	`research.data.basic`
Approval	App review with demo videos	Application with a research proposal; TikTok replies typically within 4 weeks
Daily limit	600 requests a minute per endpoint	1,000 requests a day, up to 100,000 records

Research API facts are from TikTok's Research API page and FAQ. If you do not qualify, our TikTok Research API alternative post covers other routes.

How to get a TikTok API key, step by step

Create a developer account. Sign up at developers.tiktok.com with your email. TikTok recommends creating or joining an organization, which makes handover easier later.
Connect an app. Click your profile icon, then Manage apps, then Connect an app. Choose the owner (you or your organization) and click Confirm.
Copy the Client key and Client secret from the Credentials section. Keep the secret on your server.
Fill in Basic information. A 1024 x 1024 icon (JPEG or PNG, up to 5 MB), app name, category and description. The description appears on the authorization screen.
Choose platforms. Web, Android, iOS or Desktop. Web and Desktop need a URL.
Add products. Click Add products and add Login Kit, then the Display API. Login Kit asks for a redirect URI.
Add scopes. Open Scopes and add user.info.basic and video.list. Add user.info.profile or user.info.stats only if you need bio or follower counts.
Verify URLs. Under URL properties, click Verify properties and prove ownership by domain or URL prefix. Apps created after 9 September 2024 must verify their terms, privacy policy and web URLs (TikTok's setup guide).
Submit for review. In App review, explain how you use each product and scope, upload 1 to 5 demo videos (up to 50 MB each), click Save, then Submit for review.

Review status moves from Draft to In review to Live or Not approved, with reviewer notes under History. TikTok does not publish a review time, so plan for back and forth.

Test before review with a TikTok sandbox

A sandbox lets you call the API without submitting for review. Toggle Sandbox, click Create Sandbox, Confirm, then Apply changes. You can have up to 5 sandboxes and 10 target users, and target users must be accounts you own; they can take an hour to appear (sandbox docs).

TikTok scopes

Scope	Gives you
`user.info.basic`	`open_id`, `union_id`, avatar, display name
`user.info.profile`	Bio, profile link, `is_verified`, username
`user.info.stats`	Follower, following, like and video counts
`video.list`	The user's public videos
`video.upload`, `video.publish`	Upload drafts or post directly

Full list in TikTok's scopes reference.

Get a TikTok access token

1. Send the user to authorize. Redirect URIs must be absolute HTTPS, static, with no query string, at most 10 per app (Login Kit for Web).

https://www.tiktok.com/v2/auth/authorize/?client_key=CLIENT_KEY&scope=user.info.basic,video.list&response_type=code&redirect_uri=https://example.com/tiktok/callback&state=RANDOM

2. Exchange the code on your server (token docs):

curl -X POST "https://open.tiktokapis.com/v2/oauth/token/" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_key=CLIENT_KEY&client_secret=CLIENT_SECRET&code=CODE&grant_type=authorization_code&redirect_uri=https://example.com/tiktok/callback"

The response holds access_token, expires_in, refresh_token, refresh_expires_in, open_id and scope.

TikTok token lifetime and refresh

Access tokens last 2 hours and refresh tokens 180 days (token management). Refresh with the same endpoint and grant_type=refresh_token. The refresh token can change on each refresh, so always save the one TikTok returns. The client access token used by the Research API also lasts 2 hours (7,200 seconds) and has no refresh token; request a new one (client tokens).

First request: user info and videos in Python

curl "https://open.tiktokapis.com/v2/user/info/?fields=open_id,display_name,avatar_url" \
  -H "Authorization: Bearer ACCESS_TOKEN"

import os
import requests

TOKEN = os.environ["TIKTOK_ACCESS_TOKEN"]
H = {"Authorization": f"Bearer {TOKEN}"}
API = "https://open.tiktokapis.com/v2"

me = requests.get(f"{API}/user/info/", headers=H,
                  params={"fields": "open_id,display_name,avatar_url"}, timeout=30).json()
print(me["data"]["user"]["display_name"], me["error"]["code"])

videos, cursor = [], None
while True:
    body = {"max_count": 20}
    if cursor:
        body["cursor"] = cursor
    r = requests.post(f"{API}/video/list/", headers=H, json=body, timeout=30,
                      params={"fields": "id,title,duration,cover_image_url,embed_link"}).json()
    videos += r["data"]["videos"]
    if not r["data"]["has_more"]:
        break
    cursor = r["data"]["cursor"]
print(len(videos), "videos")

A successful answer carries "error": {"code": "ok"}. The video list returns newest first (Display API guide). Each of these endpoints allows 600 requests a minute on a sliding window (rate limits).

Common TikTok API errors

Error	HTTP	Meaning and fix
`invalid_client`	OAuth	Wrong client key or secret; copy them again from Credentials
`invalid_grant`	OAuth	Code or refresh token expired, used or revoked, or redirect URI mismatch
`invalid_scope`	OAuth	Scope not added to the app or not approved
`access_token_invalid`	401	Token expired; refresh it
`scope_not_authorized`	401	The user did not grant that scope
`invalid_params`	400	Bad `fields` or body
`rate_limit_exceeded`	429	Over 600 a minute; slow down

Codes are from TikTok's OAuth errors and API v2 errors pages. Quote the log_id if you contact support.

If you just need public data

The Display API only shows users who log in to your app, and the Research API is for researchers. If you need public profiles, videos or comments of any account, ScrapeIO needs no TikTok app: the TikTok profile API, profile videos API, comments API and keyword search API each cost 1 credit, and private or missing accounts are free. Agents can use the TikTok MCP server.

curl "https://scrapeio.com/v1/tiktok/profile?handle=nike" \
  -H "x-api-key: YOUR_KEY"

FAQ

Is the TikTok client key the same as an API key?

It is the closest thing. The client key identifies your app; you still need a user or client access token for each call.

Can I use the TikTok API to get any public video's data?

Not with the Display API, which reads only users who authorize your app. Public content by query is the Research API, for approved researchers.

How long does TikTok app review take?

TikTok does not publish a time. Use the sandbox to build while you wait.

How long does a TikTok access token last?

Two hours. The refresh token lasts 180 days and can change each time you refresh.

Who can apply for the TikTok Research API?

Researchers at academic institutions in the US, EEA, UK, Canada or Switzerland, plus EU nonprofits in beta, with a proposal and ethics review. TikTok typically replies within 4 weeks.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

100 free credits, no card. Credits never expire.

Get API key