> **Community source release (MIT).** Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

# TikTok MCP by Nabux

Multi-user TikTok MCP gateway using TikTok Login Kit, Display API and Content Posting API.

Production target: `https://tiktok.nabuxai.com`  
MCP endpoint: `https://tiktok.nabuxai.com/mcp`

## MCP tools

- `tiktok_accounts`
- `tiktok_profile`
- `tiktok_list_videos`
- `tiktok_creator_info`
- `tiktok_publish_video`
- `tiktok_upload_video_draft`
- `tiktok_publish_photos`
- `tiktok_upload_photos_draft`
- `tiktok_post_status`
- `tiktok_search_cached_videos`

The gateway stores TikTok access and refresh tokens encrypted at rest, refreshes near-expiry access tokens, and scopes all MCP account selection to the authenticated Nabux owner.

## Official TikTok APIs used

- Login Kit OAuth 2.0
- User Info / Display API
- Video List API
- Content Posting API Direct Post
- Content Posting API Upload/Draft
- Post Status API

Default requested scopes:

```text
user.info.basic
user.info.profile
user.info.stats
video.list
video.publish
video.upload
```

Only request/approve the scopes your production product needs.

## Posting flow

Before Direct Post, call `tiktok_creator_info` and respect the privacy/interaction options returned for that creator.

The first version uses TikTok `PULL_FROM_URL` for video/photo transfer. Media URLs must be HTTPS, not redirect, remain accessible during TikTok's download, and normally belong to a Domain or URL Prefix verified in the TikTok developer app.

Video Direct Post uses `/v2/post/publish/video/init/` with `video.publish`.
Photo Direct Post/Upload uses `/v2/post/publish/content/init/`.
Draft video upload uses `/v2/post/publish/inbox/video/init/` with `video.upload`.
Status uses `/v2/post/publish/status/fetch/`.

Important: content posted by unaudited Direct Post API clients is restricted by TikTok to private viewing until the client passes TikTok's audit.

## OAuth

Configure Login Kit Web redirect URI exactly:

```text
https://tiktok.nabuxai.com/tiktok/callback
```

TikTok access tokens are short-lived; refresh tokens are persisted encrypted so the gateway can renew access without requiring the user to reconnect on each expiry.

## Data collection

`tiktok_list_videos` uses the official Display API and caches returned video metadata in the account's local tenant-isolated cache. `tiktok_search_cached_videos` searches that retained data. This is not browser/session scraping and is limited to data the authorized APIs expose.

## Coolify

Deploy branch `feature/tiktok-mcp-gateway` with `docker-compose.coolify.yml`, routing `tiktok.nabuxai.com` to port 8000.

Required configuration:

```text
PUBLIC_BASE_URL=https://tiktok.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
TT_CLIENT_KEY=<TikTok client key>
TT_CLIENT_SECRET=<TikTok client secret>
TT_REDIRECT_URI=https://tiktok.nabuxai.com/tiktok/callback
INTERNAL_SERVICE_TOKEN=<random service token>
```

For PULL_FROM_URL publishing, also verify the media domain/URL prefix in the TikTok app dashboard.

## Status

Production-shaped implementation. Real E2E posting requires a TikTok developer app with Login Kit and Content Posting API, approved scopes, exact redirect URI, verified media URL property, and an authorized TikTok creator. Public Direct Post requires TikTok audit approval.