Why Developers Need App Approval to Post to TikTok Publicly

Why does my app need approval to post to TikTok?

Your integration needs app approval to post to TikTok publicly because TikTok locks every unaudited Content Posting API client into private viewing mode. The Direct Post reference states the rule on its first screen: "All content posted by unaudited clients will be restricted to private viewing mode." The same page names the way out: "to lift the restriction on content visibility, your API client must undergo an audit to verify compliance with our Terms of Service."

So the API works before approval. It just doesn't publish anything anyone else can see. TikTok's App Review FAQ even has a question for developers who notice this the hard way, "Why are my posts private using the Content Posting API?", and the answer is the same sentence.

What can an unaudited TikTok app do?

Very little in public. The Content Sharing Guidelines list two restrictions that apply until the audit passes:

The user cap is the one that surprises people. It does not only limit visibility. It limits your app to five posting users a day, and each of those users has to switch their whole TikTok account to private before the post goes through.

If any of those accounts is public, the call fails before a single byte of video moves. The Direct Post error table lists it under HTTP 403:

Do the private posts become public after the audit?

No. Passing the audit changes what your app can do next, not what it already posted. TikTok spells out the manual path for content posted before approval: "To make the contents publicly viewable later on, the account owner must first change their account visibility to public, and then change the privacy settings of each content to 'Everyone.'"

That is a per-post edit, done by the creator inside TikTok. Your app cannot flip those posts for them.

Is the audit the same as TikTok's app review?

No. There are two separate gates, and they approve different things.

The first is app review, which grants the scope. The Direct Post getting-started guide lists it as a prerequisite: "Your app must be approved for the video.publish scope," and "The target TikTok user must have authorized your app for the video.publish scope." TikTok's App Review FAQ says this review "may take several days to two weeks after submission."

The second is the Content Posting API audit, which lifts the private-only restriction. You apply for it through a form on the TikTok for Developers site at developers.tiktok.com/application/content-posting-api, which requires a developer login. TikTok does not publish a timeline for the audit anywhere in the docs quoted here.

An app can pass the first gate and still sit behind the second. That app has video.publish, calls /v2/post/publish/video/init/ successfully, and posts nothing public.

What does the TikTok audit check?

Two things, according to the Content Sharing Guidelines: what your app is for, and how its posting screen behaves.

The intended-use rules rule out a lot of internal tooling. TikTok says API clients "must not be limited to test applications and should be intended for a wide audience, not limited to internal groups/private use." It gives an example of what fails: "A utility tool to help upload contents to the account(s) you or your team manages." Another listed failure is "An app that copies arbitrary contents from other platforms to TikTok." The App Review Guidelines add that "Apps must not be for private or personal use" and "Apps that are still in development or testing will not be approved."

The UX rules are specific enough to build a checklist from:

• The posting page must show the creator's nickname, pulled fresh from creator_info.
• The privacy setting must come from privacy_level_options, and "Users must manually select the privacy status from a dropdown and there should be no default value."
• Comment, Duet and Stitch toggles must start unchecked, and greyed out when creator_info says the creator disabled them.
• Your app must check the video against max_video_post_duration_sec.
• A commercial content disclosure toggle must be off by default, with "Your brand" and "Branded content" options.
• The screen must show "By posting, you agree to TikTok's Music Usage Confirmation" before the publish button.
• Users must see a preview, and content must only go to TikTok "after the user has expressly consent to the upload."

Most of those fields come from one endpoint, and the note on TikTok creator_info and max_video_post_duration_sec walks through what it returns and which values change between public and private accounts.

The app review side wants proof on video. TikTok asks for "At least one demo video that shows the complete end-to-end flow," with "a maximum of 5 videos, up to 50 MB each." If the app has never been approved, "you are required to use a sandbox environment on the Developer Portal to demonstrate the integration."

Which limits stay after the audit?

Two caps apply to audited and unaudited clients alike, and the guidelines list both:

• Creator cap: "There will be a 24-hour active creator cap for each API client based on the usage estimates provided in the audit application form."
• Posting cap: "The upper limit may vary among creators (typically around 15 posts per day/ creator account) and is shared across all API Clients using Direct Post."

The creator cap is tied to the numbers you type into the audit form, so low estimates come back as a low ceiling. When you hit it, the init call returns 403 reached_active_user_cap. The posting cap returns 403 spam_risk_too_many_posts, and because it is shared across every app, a creator who posts from three tools uses up the same allowance. TikTok's App Review FAQ says you can ask Support to raise the active user cap, but "your app must be in production to request and increase, and not all requests will be approved."

The per-token rate limit also stays: "Each user access_token is limited to 6 requests per minute" on the init endpoint.

Does the Upload endpoint need the audit too?

TikTok does not say. The Upload guide, which sends a draft to the creator's TikTok inbox through /v2/post/publish/inbox/video/init/, requires approval for the video.upload scope and does not repeat the unaudited-visibility note that the Direct Post pages carry. With Upload, the creator finishes the post inside TikTok's own editor, and TikTok's docs say users "must click on inbox notifications to continue the editing flow in TikTok and complete the post."

Treat that as a gap rather than an exemption. The Content Sharing Guidelines place the audit under the heading "Direct Post API - Developer Guidelines," and nothing on the Upload page states whether the 5-user cap applies there.

What other approval does TikTok require for posting?

Domain verification, if you send media by URL. PULL_FROM_URL fails with 403 url_ownership_unverified unless you have verified the domain or URL prefix the video lives on. It is a separate check from the audit, and passing one does not satisfy the other. The note on TikTok PULL_FROM_URL domain verification covers how to verify a prefix. If you upload the file directly instead, the chunking rules in the note on the TikTok API chunk size limit apply.

Frequently asked questions

Why are my TikTok API posts showing as private?

Your API client has not passed the Content Posting API audit. TikTok restricts all content from unaudited clients to private viewing mode, and posts go out as SELF_ONLY.

How many users can post through an unaudited TikTok app?

Five in a 24-hour window. TikTok also requires every one of those accounts to be set to private at the time of posting.

What does unaudited_client_can_only_post_to_private_accounts mean?

The creator's TikTok account is public and your app has not passed the audit. TikTok blocks the request at /publish/video/init/ with HTTP 403.

How long does TikTok's Content Posting API audit take?

TikTok does not publish a timeline for the audit. The only published review time is for app review, which TikTok says "may take several days to two weeks after submission."

Can an internal tool for my own accounts pass the TikTok audit?

TikTok's guidelines list "A utility tool to help upload contents to the account(s) you or your team manages" as not acceptable. Apps must be intended for a wide audience.

Will passing the audit make my earlier private posts public?

No. The creator has to switch the account to public and then change each post's privacy setting to "Everyone" inside TikTok.

Is video.publish approval enough to post publicly to TikTok?

Not by itself. App review grants the video.publish scope, and it is separate from the Content Posting API audit that lifts the private-only restriction. An app with only the scope can call /v2/post/publish/video/init/, but its posts stay SELF_ONLY.

What happens when my TikTok app hits the active creator cap?

The init call returns 403 reached_active_user_cap. The cap is based on the usage estimates you gave in the audit application form. You can ask TikTok Support to raise it, but your app must be in production and not all requests are approved.

What does the posting screen need to show to pass TikTok's audit?

It shows the creator's nickname from creator_info and a privacy dropdown with no default value, filled from privacy_level_options. The Comment, Duet and Stitch toggles start unchecked, and the commercial content disclosure toggle is off by default. The "Music Usage Confirmation" line sits before the publish button, and users see a preview before anything is sent.

Do I need to verify a domain to post TikTok videos by URL?

Only if you send media with PULL_FROM_URL. Without a verified domain or URL prefix, the call fails with 403 url_ownership_unverified. That check is separate from the audit, and passing one does not satisfy the other.