TikTok automation: what the official API allows, and what gets videos flagged

TikTok automation through the official API means one thing: publishing. The Content Posting API either posts straight to a creator's profile or drops the file in their TikTok inbox for them to finish. Comments and direct messages are not exposed to third party apps. And until your app passes TikTok's audit, everything it publishes stays private.

That last sentence is where most projects die. People build a TikTok scheduler, publish their first video, see nothing on the profile, and assume the upload failed. It did not. It is private because the API client has not been audited yet.

What the official TikTok API actually automates

Four things, and no more:

So an automation that follows accounts, likes videos or answers comments on TikTok is not using the API. It is driving the app or the website with a script, which is a different risk profile entirely. I wrote the Instagram version of that distinction in Instagram bots in 2026, and the shape is identical on TikTok.

Direct post or inbox upload: pick before you build

The Content Posting API ships two flows, and they are not interchangeable.

Direct post goes to /v2/post/publish/video/init/ and publishes to the authorized creator's profile without them touching the app. It needs the video.publish scope, approved on your app and authorized by the user. You must send post_info.privacy_level, and the value has to be one that the creator info endpoint returned in privacy_level_options: PUBLIC_TO_EVERYONE, MUTUAL_FOLLOW_FRIENDS, FOLLOWER_OF_CREATOR or SELF_ONLY. Guess a value the creator has not enabled and the call fails at initialization.

Inbox upload goes to /v2/post/publish/inbox/video/init/ and needs video.upload. The video lands in the creator's TikTok inbox, and the docs are blunt about what happens next: they must "click on inbox notifications to continue the editing flow in TikTok and complete the post." Nothing publishes on its own. TikTok asks developers to say so in the interface, because otherwise users wait for a post that never comes.

Media transfer is the same for both. Set source to PULL_FROM_URL and give a video_url, or FILE_UPLOAD and give a video_size. The file limits, read today:

Six requests per minute per token is the number that breaks naive schedulers. If you queue twenty videos for one creator at 9am, you are rate limited within seconds.

The audit: why your videos publish as private

TikTok gates content visibility behind an app audit. The docs state it plainly: "All content posted by unaudited clients will be restricted to private viewing mode." To lift that, the API client "must undergo an audit" that checks compliance with TikTok's Terms of Service.

What that means in practice:

• You can build and test the whole flow with no audit. Videos arrive, they are just private.
• Before the audit, publish attempts to public accounts are blocked at initialization. Unaudited clients post to private accounts only.
• After the audit, privacy_level behaves as documented and public posting works.

If you are automating only your own accounts, the audit is paperwork between you and a working integration. If you are shipping a product, plan for it in the timeline. This is the same gate pattern as Meta app review, which I covered in the Instagram Graph API in 2026.

How to automate TikTok posts without running your own client

Three families, and the price I read on each vendor's own page on October 19, 2026.

Buffer, Metricool and Later are calendars: a human writes, the tool publishes. The growth bots are the third family, and they are not using the Content Posting API, because the API has no follow, like or comment endpoint. They automate the app itself.

PlugKit sits in between: it holds the TikTok OAuth and token refresh, and POST /v1/posts with a public .mp4 URL in mediaUrls publishes the video. publishNow: true posts immediately, asDraft: true sends it to the app's drafts instead, which is the closest thing to the inbox flow. privacy maps to TikTok's privacy levels, and allowComment, allowDuet and allowStitch set what other people can do with the video. Two honest limits: PlugKit cannot read or manage TikTok comments, because the API does not expose them, and TikTok has no unlisted option, so unlisted and private both publish as SELF_ONLY.

Analytics need the video.list and user.info.stats scopes, and they are not retroactive. An account connected before those scopes existed returns no analytics and no error, which looks like a bug and is a reconnection.

TikTok posting automation that does not get flagged

The API docs do not publish a list of flag triggers, so here is what the documented behaviour tells you:

• Respect the creator's own settings. If a creator has turned Duets off, allowDuet: true does not override it. The creator wins, always.
• Query privacy_level_options first. Sending a privacy level the creator has not enabled fails the init call. That is the API protecting the account, not an error to retry.
• Stay under 6 requests per minute per token. Spread a queue, do not burst it.
• Do not reach outside the API. The audit checks Terms of Service compliance. An integration that pairs official publishing with a browser script doing follows and comments is the one that costs an account.
• Publish per platform, not once for everything. The same caption cross-posted everywhere underperforms. I argue that case in one draft, one variant per platform.

If an agent is doing the writing, the publishing step is the same API call. How to give an AI agent social media access covers that wiring, and the hub at Instagram and social automation lists the platform by platform pages.

FAQ

Is TikTok automation allowed?

Publishing is. TikTok ships an official Content Posting API with video.publish and video.upload scopes, and tools built on it are using a supported path. Automating follows, likes, comments or mass DMs is not, because no endpoint exists for them: those tools drive the app or the website instead.

Why does my API video post as private?

Because your API client has not passed TikTok's audit. The docs say all content posted by unaudited clients is restricted to private viewing mode, and publish attempts to public accounts are blocked at initialization. Pass the audit and privacy_level works as documented.

What is the difference between direct post and inbox upload on TikTok?

Direct post publishes to the creator's profile with no further action, needs video.publish, and requires a privacy_level the creator has enabled. Inbox upload needs video.upload and leaves the video in the creator's TikTok inbox, where they must open the notification and finish the post themselves.

Can I read or reply to TikTok comments through the API?

No. TikTok does not expose comments or messaging to third party apps. You can set allowComment when you publish, which decides whether others may comment at all, but there is no endpoint to list or answer them. Any tool claiming otherwise is automating the app.

How many TikTok posts can I publish per minute?

Six requests per minute per user access token, on both the direct post and the inbox endpoints. The docs mention a daily post cap without giving a number, so build retries with backoff and spread scheduled queues rather than firing them together.

AB

Antoine BlancoFounder of PlugKit. Runs his own Instagram, YouTube and X accounts through the API and MCP server described here.