# TikTok Content Posting API: Who Can Post and What the Audit Requires (2026)

Source: https://blog.lots.social/tiktok-content-posting-api
Published: 2026-10-27T00:30:25.798064+00:00

Any developer can build against TikTok's Content Posting API, but until TikTok audits your API client, every post it publishes is forced to private viewing (`SELF_ONLY`), only 5 users can post in 24 hours, and their accounts must be private. The audit lifts that, and it checks the posting screen in your app against TikTok's UX rules as well as your code.

I read TikTok for Developers' own Content Posting API pages on 26 October 2026 and put the access steps, the audit rules, the limits and the error codes in one place. TikTok's pages are dated 4 to 24 August 2026; I link each one at the end.

## TikTok Content Posting API at a glance: Direct Post vs Upload

The API has two ways to send a video or photo to a creator's account. Direct Post publishes it. Upload sends it to the creator's TikTok inbox as a draft that the creator finishes in TikTok.

| | Direct Post | Upload (inbox draft) |
|---|---|---|
| Video endpoint | `/v2/post/publish/video/init/` | `/v2/post/publish/inbox/video/init/` |
| Photo endpoint | `/v2/post/publish/content/init/` with `post_mode: DIRECT_POST` | same endpoint with `post_mode: MEDIA_UPLOAD` |
| Scope the app needs | `video.publish` | `video.upload` |
| Who finishes the post | Your app: the creator picks every setting on your screen | The creator, in TikTok's editor, after tapping an inbox notification |
| Audit | Required to leave private viewing | The Upload pages I read mention no audit |
| Init requests | 6 per minute per user token | 6 per minute per user token |
| Other caps | About 15 posts a day per creator account, shared across all apps; a daily active-creator cap for your client | At most 5 pending shares in any 24 hours |
| Photo limits | Up to 35 images; title 90 characters, description 4,000 | Same endpoint, same limits; needs TikTok app 31.8 or later |

Status checks (`/v2/post/publish/status/fetch/`) are limited to 30 requests a minute per user token. The creator info query that Direct Post needs first is limited to 20 a minute.

## Who can use the Content Posting API

There are three gates before a post goes out, and they are easy to mix up.

**1. Your app is approved.** You register an app on TikTok for Developers, add the Content Posting API product, configure Direct Post if you want it, and submit the app for review. TikTok's app review FAQ says review "may take several days to two weeks"; its developer guidelines say it provides no official timeline and no guarantee of approval. The review looks at:

- a custom app name and a clear icon (1024 x 1024 px, up to 5 MB);
- a description of what the app does, with a real website that isn't just a landing page or login page, and visible Privacy Policy and Terms of Service links;
- a written explanation of how each product and scope is used;
- at least one demo video of the full flow, up to 5 videos of up to 50 MB each. An app that hasn't been approved before has to record it in a sandbox;
- verified ownership of your URLs. Apps that use the Content Posting API upload URL must verify those URLs, whatever date the app was created.

Two review rules matter for this API: apps must not be for private or personal use, and apps still in development or testing won't be approved.

**2. Your scope is approved and the creator authorizes it.** The app must be approved for `video.publish` (Direct Post) or `video.upload` (Upload), and each TikTok user must also grant that scope to your app. TikTok's scopes page notes that being approved for a scope doesn't give you a user's data on its own.

**3. Your client is audited (Direct Post only).** This is the gate people trip on, and the next section covers it.

TikTok's sandbox is a restricted environment for trying integrations before review. You can create up to 5 sandboxes and add up to 10 target accounts. TikTok's own sandbox page says it doesn't offer Content Posting API access for public videos.

## What unaudited means: private posts only

TikTok's Content Sharing Guidelines (last updated 4 August 2026) say you can use Direct Post unaudited, but everything you post is restricted to private viewing. Specifically:

- **User cap:** an unaudited client can let up to 5 users post in a 24-hour window.
- **Private accounts:** every account posting through the client must be set to private at the time of posting.
- **Visibility:** only `SELF_ONLY`. To make a post public later, the account owner first switches the account to public, then sets each post to "Everyone".

If you try anyway, `/publish/video/init/` returns `403 unaudited_client_can_only_post_to_private_accounts`, and TikTok says the publish attempt is blocked there.

Audited or not, two more caps apply: a 24-hour active-creator cap per client, based on the usage estimates you gave in the audit application, and a per-creator posting cap that TikTok says is typically around 15 posts a day per creator account and shared across every Direct Post client.

## What the TikTok audit requires

The audit application lives in the developer portal at `developers.tiktok.com/application/content-posting-api`, which asks you to sign in, so I can only report what TikTok's public pages say. TikTok says the audit verifies compliance with its Terms of Service. The Content Sharing Guidelines are the checklist, and they cover two things: what your app is for, and what your posting screen must do.

### Intended use

- Your client must help authentic creators post original content. TikTok lists an app that copies arbitrary content from other platforms as not acceptable.
- Your client must not be limited to test applications and must be meant for a wide audience, not internal or private use. TikTok's example of what isn't acceptable is a utility tool that uploads content to the account or accounts you or your team manage.

That second rule is the one that decides what you can build. A script that posts to your own company's accounts doesn't fit the Direct Post audit as TikTok describes it.

### Required UX on your posting screen

| Requirement | What TikTok says |
|---|---|
| Creator info | Query creator info each time you render the post page. Show the creator's nickname. If TikTok says the creator can't post right now, stop and ask the user to try later. Check the video length against `max_video_post_duration_sec` |
| Title | Let the user enter one |
| Privacy | A dropdown built from the `privacy_level_options` TikTok returns, with no default value |
| Interactions | Allow Comment, Duet and Stitch, none ticked by default, greyed out when the creator disabled them in TikTok. Photo posts show only Comment |
| Music consent | Before the publish button, show: "By posting, you agree to TikTok's Music Usage Confirmation" |
| Commercial content | A disclosure toggle, off by default, with "Your brand" and "Branded content". At least one must be chosen or the publish button stays disabled. "Your brand" is labelled "Promotional content"; "Branded content", or both, is labelled "Paid partnership" |
| Branded content visibility | Branded content can't be private: disable "only me" with a hover note, or switch visibility automatically with a notice |
| Declarations | "Your brand" only: the Music Usage Confirmation. Branded content, alone or with your brand: the Branded Content Policy and Music Usage Confirmation |
| Awareness and control | Show a preview; add no watermark or logo; let the user edit preset text and hashtags; send content only after the user has expressly agreed; tell the user processing can take a few minutes; poll the status endpoint or handle webhooks |

TikTok's watermark rule goes further: your app must not add a brand name, logo, watermark, link or promotional text to shared content, and violations can lead to deleted content or disabled accounts.

One technical rule also shows up in the audit guidance: use `PULL_FROM_URL` when the files already sit on your servers, and `FILE_UPLOAD` when they are on the user's device. Pull URLs must be on a domain or URL prefix you've verified.

## Media rules for the Content Posting API

From TikTok's Media Transfer Guide (last updated 4 August 2026):

| | Video | Photo |
|---|---|---|
| Formats | MP4 (recommended), WebM, MOV | WebP, JPEG |
| Codecs | H.264 (recommended), H.265, VP8, VP9 | n/a |
| Size | Up to 4 GB; each side 360 to 4096 px; 23 to 60 FPS | Up to 20 MB per image, maximum 1080p |
| Length | Up to 10 minutes through the API. All creators can post 3-minute videos; some have 5 or 10 | up to 35 images per post |

For `FILE_UPLOAD`, files under 5 MB go up whole. Larger files go in chunks of 5 to 64 MB (the last chunk can be up to 128 MB), 1 to 1,000 chunks, uploaded in order; files over 64 MB must be chunked. The `upload_url` is valid for one hour. For `PULL_FROM_URL`, the URL must be HTTPS, must not redirect, and has to stay reachable for the whole download, which times out an hour after it starts.

## Error codes you'll meet

| Code | HTTP | Meaning |
|---|---|---|
| `unaudited_client_can_only_post_to_private_accounts` | 403 | Unaudited client; blocked at init |
| `reached_active_user_cap` | 403 | Your client used its daily quota of active publishing users |
| `spam_risk_too_many_posts` | 403 | The creator hit the daily API post cap |
| `spam_risk_too_many_pending_share` | 403 | More than 5 pending inbox shares in 24 hours (Upload) |
| `spam_risk_user_banned_from_posting` | 403 | TikTok has banned the creator from new posts |
| `url_ownership_unverified` | 403 | The pull URL's domain or prefix isn't verified |
| `privacy_level_option_mismatch` | 403 | `privacy_level` missing or not in the creator's options. TikTok says repeats suggest a UX violation |
| `scope_not_authorized` | 401 | The token lacks the `video.publish` or `video.upload` grant |
| `access_token_invalid` | 401 | Token invalid or expired |
| `rate_limit_exceeded` | 429 | Over the per-token limit |
| `app_version_check_failed` | 400 | Photo upload needs TikTok app version 31.8 or later |

## After you post: moderation and status

`status/fetch` returns `PROCESSING_UPLOAD` or `PROCESSING_DOWNLOAD`, then `PUBLISH_COMPLETE` for a Direct Post, or `SEND_TO_USER_INBOX` for an Upload draft (which becomes `PUBLISH_COMPLETE` once the creator posts it). TikTok says processing takes under half a minute for 512 MB, about a minute for 1 GB and over two minutes for 4 GB. A post published for public viewing goes through TikTok's moderation first, and you don't get the `post_id` until it's done: usually within a minute, sometimes a few hours. Webhooks cover `post.publish.failed`, `post.publish.complete`, `post.publish.inbox_delivered` and `post.publish.publicly_available`.

One more dated note: TikTok's developer changelog (last updated 26 August 2026) lists no Content Posting API change since photo support on 3 November 2023, but the Direct Post and Photo reference pages both say "last updated 24 August 2026". TikTok says the changelog isn't exhaustive, so check the reference pages.

## Three ways to post to TikTok from code

1. **Build your own Direct Post app and pass the audit.** Right if you're building a product for many creators. You need the posting screen above, verified domains, app review and the audit, and a client that doesn't exist only for accounts you manage.
2. **Use Upload.** The creator finishes each post in TikTok. It needs `video.upload` and app review, and its pages describe no audit. It suits workflows where a person reviews every post anyway, and it carries the 5-pending-shares cap.
3. **Use a tool that already holds TikTok access** and connect your account by signing in to TikTok. You skip the developer account, review and audit. What the tool can publish then depends on how that tool's own TikTok app is set up.

## Posting to TikTok from your AI agent with LotsSocial

TikTok is one of the 12 networks in LotsSocial. You don't register a TikTok developer app or apply for an audit. Ask your agent to connect TikTok and it calls `get_connect_link` for TikTok and gives you a secure link; you approve on TikTok's own page. You add `https://api.lots.social/mcp` to ChatGPT, Claude, Claude Code, Cursor, Codex or any agent with remote MCP support, or use the REST API, and the dashboard does the same job by hand with its composer, calendar and bulk scheduling.

Before anything is saved, `validate_social_post` checks a post against the same rules the dashboard uses. On 26 October 2026 I ran it as a dry run (nothing saved or posted) against a connected TikTok account with a caption and no video. As a draft it came back valid with a `media_required` warning; as a scheduled post it came back with an error for the same reason. The account's caption limit showed as 2,200 characters, and LotsSocial's public rules list the same photo limits TikTok publishes: a 90-character title and a 4,000-character description. Your agent can't publish a TikTok post that has no video or image, and it learns that before it schedules.

LotsSocial also runs its own TikTok app, and on workspaces where it's switched on, TikTok lets LotsSocial post directly to an account only after you approve the post in LotsSocial, so an agent can't publish or schedule there by itself. `get_account_details` shows this as `direct_post_needs_approval`. The agent then does one of two things: it sends the video to your TikTok inbox as a draft with `platform_fields` set to `{"tiktok": {"send_as_draft": true}}`, or it saves a draft and hands you a review link. In that link you choose privacy, interactions and commercial-content disclosure yourself, which is the screen TikTok's guidelines describe. LotsSocial's own cap for inbox drafts is 5 unfinished drafts in 24 hours, the same number TikTok publishes for pending shares.

You pay per connected account, and each TikTok account is one: $2 per account a month with no plan, or plans of 12 accounts for $20, 40 for $59 and 150 for $149 a month (yearly $200, $590 and $1,490), with extra accounts at your plan's rate. Posts are unlimited. New accounts get 5,000 free credits, valid 90 days, no card. Prices checked on 26 October 2026 at [lots.social/pricing](https://lots.social/pricing).

Give your agent this and let it set itself up:

> Read https://lots.social/skill.md and help me connect LotsSocial for you, then connect my TikTok account and check a TikTok video post with validate_social_post before saving it.

The full connection walkthrough is in [how to connect your social accounts to your AI agent](https://blog.lots.social/connect-social-accounts-to-ai-agent), and [what an agent can and can't do with your accounts](https://blog.lots.social/is-lotssocial-safe) covers permissions. For other networks' rules, here are [Instagram's API publishing limits](https://blog.lots.social/instagram-api-publishing-limits-and-requirements), [X API pricing and access](https://blog.lots.social/x-api-pricing-and-access) and [LinkedIn's profile vs Page rules](https://blog.lots.social/linkedin-api-posting-profile-vs-page).

## Common questions

### Do I need an audit to use the TikTok Content Posting API?

Only to post publicly with Direct Post. Without an audit you can build and test, but every post is private (`SELF_ONLY`), at most 5 users can post in 24 hours and their accounts must be private. TikTok's Upload pages mention no audit.

### Why are my TikTok API posts private?

Because your API client hasn't been audited. TikTok's FAQ answers this directly: content posted by unaudited clients is restricted to private viewing, and the restriction lifts only after an audit.

### How long does the TikTok audit take?

TikTok's pages give no timeline for the audit. For app review, its FAQ says several days to two weeks, and its developer guidelines say there is no official timeline or guarantee of approval. Plan your launch around that.

### Can I use the Content Posting API for my own or my company's accounts?

Not for Direct Post as TikTok describes the audit. Its guidelines list a utility tool that uploads content to accounts you or your team manage as not acceptable, and app review says apps must not be for private or personal use. If you only need to post to accounts you own, a tool that already holds TikTok access is the shorter route.

### What are the TikTok API posting limits?

About 15 posts a day per creator account, shared across all Direct Post apps; 6 init requests a minute per user token; at most 5 pending inbox drafts in 24 hours for Upload; and a daily active-creator cap for your client that depends on the usage you gave in the audit application.

### Can an AI agent post to TikTok through LotsSocial?

Yes. Your agent connects your TikTok account through a link you approve, checks the post with `validate_social_post`, and schedules or posts it, as long as it includes a video or image. Where TikTok requires your approval first, it sends the video to your TikTok inbox as a draft or gives you a review link to publish from.

*TikTok details checked on 26 October 2026 from TikTok for Developers: [Get Started - Direct Post](https://developers.tiktok.com/doc/content-posting-api-get-started) (updated 4 August 2026), [Get Started - Upload](https://developers.tiktok.com/doc/content-posting-api-get-started-upload-content) (4 August), [Content Sharing Guidelines](https://developers.tiktok.com/doc/content-sharing-guidelines) (4 August), [Direct Post reference](https://developers.tiktok.com/doc/content-posting-api-reference-direct-post) (24 August), [Upload Video reference](https://developers.tiktok.com/doc/content-posting-api-reference-upload-video) (4 August), [Photo reference](https://developers.tiktok.com/doc/content-posting-api-reference-photo-post) (24 August), [Query Creator Info](https://developers.tiktok.com/doc/content-posting-api-reference-query-creator-info) (4 August), [Get Post Status](https://developers.tiktok.com/doc/content-posting-api-reference-get-video-status) (4 August), [Media Transfer Guide](https://developers.tiktok.com/doc/content-posting-api-media-transfer-guide) (4 August), [App Review Guidelines](https://developers.tiktok.com/doc/app-review-guidelines) (4 August), [App Review FAQ](https://developers.tiktok.com/doc/getting-started-faq) (4 August), [Register Your App](https://developers.tiktok.com/doc/getting-started-create-an-app) (4 August), [Add a Sandbox](https://developers.tiktok.com/doc/add-a-sandbox) (4 August), [Developer Guidelines](https://developers.tiktok.com/doc/our-guidelines-developer-guidelines) (4 August), [Scopes Overview](https://developers.tiktok.com/doc/scopes-overview) (19 August) and the [changelog](https://developers.tiktok.com/doc/changelog) (26 August). LotsSocial details from [api.lots.social/docs.md](https://api.lots.social/docs.md), [tools.json](https://api.lots.social/tools.json) and the [rules endpoint](https://api.lots.social/api/v1/lotssocial/rules). TikTok changes these pages; check them for the latest.*