Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

TikTok MCP by Nabux

Multi-user TikTok MCP gateway using TikTok Login Kit, Display API and Content Posting API.

Production target: https://tiktok.nabuxai.com
MCP endpoint: https://tiktok.nabuxai.com/mcp

MCP tools

• tiktok_accounts

• tiktok_profile

• tiktok_list_videos

• tiktok_creator_info

• tiktok_publish_video

• tiktok_upload_video_draft

• tiktok_publish_photos

• tiktok_upload_photos_draft

• tiktok_post_status

• tiktok_search_cached_videos

The gateway stores TikTok access and refresh tokens encrypted at rest, refreshes near-expiry access tokens, and scopes all MCP account selection to the authenticated Nabux owner.

Related MCP server: tiktok-studio-mcp

Official TikTok APIs used

• Login Kit OAuth 2.0

• User Info / Display API

• Video List API

• Content Posting API Direct Post

• Content Posting API Upload/Draft

• Post Status API

Default requested scopes:

user.info.basic
user.info.profile
user.info.stats
video.list
video.publish
video.upload

Only request/approve the scopes your production product needs.

Posting flow

Before Direct Post, call tiktok_creator_info and respect the privacy/interaction options returned for that creator.

The first version uses TikTok PULL_FROM_URL for video/photo transfer. Media URLs must be HTTPS, not redirect, remain accessible during TikTok's download, and normally belong to a Domain or URL Prefix verified in the TikTok developer app.

Video Direct Post uses /v2/post/publish/video/init/ with video.publish. Photo Direct Post/Upload uses /v2/post/publish/content/init/. Draft video upload uses /v2/post/publish/inbox/video/init/ with video.upload. Status uses /v2/post/publish/status/fetch/.

Important: content posted by unaudited Direct Post API clients is restricted by TikTok to private viewing until the client passes TikTok's audit.

OAuth

Configure Login Kit Web redirect URI exactly:

https://tiktok.nabuxai.com/tiktok/callback

TikTok access tokens are short-lived; refresh tokens are persisted encrypted so the gateway can renew access without requiring the user to reconnect on each expiry.

Data collection

tiktok_list_videos uses the official Display API and caches returned video metadata in the account's local tenant-isolated cache. tiktok_search_cached_videos searches that retained data. This is not browser/session scraping and is limited to data the authorized APIs expose.

Coolify

Deploy branch feature/tiktok-mcp-gateway with docker-compose.coolify.yml, routing tiktok.nabuxai.com to port 8000.

Required configuration:

PUBLIC_BASE_URL=https://tiktok.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
TT_CLIENT_KEY=<TikTok client key>
TT_CLIENT_SECRET=<TikTok client secret>
TT_REDIRECT_URI=https://tiktok.nabuxai.com/tiktok/callback
INTERNAL_SERVICE_TOKEN=<random service token>

For PULL_FROM_URL publishing, also verify the media domain/URL prefix in the TikTok app dashboard.

Status

Production-shaped implementation. Real E2E posting requires a TikTok developer app with Login Kit and Content Posting API, approved scopes, exact redirect URI, verified media URL property, and an authorized TikTok creator. Public Direct Post requires TikTok audit approval.