Documentation

Both portals are authenticated with a single x-api-key header. The key carries its own expiry date, so there is nothing else to configure and no token to refresh.

Quick start

1
Get a key

Verify your email for a free trial key, or buy a plan.

2
Send the header

Add x-api-key to every request you make.

3
Call an endpoint

Try requests live in the explorer on either portal.

Authentication

There is no login step. Your key is bound to the email address on your account and stops working the moment the subscription expires.

HeaderValue
x-api-key Your key from My keys
Content-Type application/json

The quickest way to try a request is the explorer on either portal: paste your key into the API Authentication box and every endpoint becomes callable from the page.

Base URLs

Mobile API
https://mobile-api.tikapis.com
56 apps

Android, iOS and Windows clients across Global, China and Default regions.

Open explorer
Web API
https://web-api.tikapis.com
10 apps

Browser and web clients: TikTok Web, TikTok Ads, CapCut Web and TikTok Music.

Open explorer

Endpoint groups

What each group covers. The live explorers hold the full request and response schema for every endpoint.

Signing and decryption for the ByteDance mobile clients: X-Argus, X-Gorgon, X-Khronos and X-Ladon headers for both Global and China regions.

POST /algorithm/sign Generate the security headers for a request
POST /algorithm/china/sign Same, for the China region
POST /algorithm/generate-keypair Generate an ECDSA key pair
POST /x-argus/decrypt Decrypt an X-Argus value
POST /x-ladon/decrypt Decrypt an X-Ladon value
POST /x-medusa/decrypt Decrypt an X-Medusa header
POST /helios/encrypt Encrypt a Helios payload
POST /helios/decrypt Decrypt a Helios payload

Full account lifecycle: registration, login, verification codes and sessions.

POST /passport/register Email registration
POST /passport/login Log in with a username or email
POST /passport/email/signup Send an email verification code
POST /passport/email/check_code Check an email code
POST /passport/mobile/send_code Send an SMS code
POST /passport/mobile/check_code Check an SMS code
POST /passport/account_reset Look up an account for reset
POST /passport/token/beat Keep a session token alive

Profile reads and writes, social actions, video statistics and comments.

POST /user/info Get account info
POST /user/profile Get a user profile
POST /user/posts List a user's posts
POST /user/followers/{user_id} List followers
POST /user/follow/{user_id}/{sec_uid} Follow a user
POST /user/edit-nickname Change the display name
POST /like/{aweme_id} Like a video
POST /comment/publish/{aweme_id} Publish a comment
POST /stats/{aweme_id} Read video statistics

Device registration and the mobile security SDK: seeds, tokens and reports.

GET /apps List every supported application
POST /device_register Register a device, platform auto-detected
POST /mssdk/get_seed Get an MSSDK seed
POST /mssdk/get_token Get an MSSDK token
POST /mssdk/ri_report Send a risk intelligence report

Publish media with automatic media-type detection and CRC32 verification.

POST /share/video Upload a video
POST /share/photo Upload a photo
POST /share/story Share a story

Signature generation for browser clients: X-Bogus, X-Gnarly and StrData.

POST /algorithm/signature Build a request signature
POST /algorithm/x-bogus/decode Decode an X-Bogus value
POST /algorithm/x-gnarly/decode Decode an X-Gnarly value
POST /strData/encode Encode StrData
POST /strData/decode Decode StrData
POST /mssdk/info/encrypt Encrypt MssdkInfo
POST /mssdk/info/decrypt Decrypt MssdkInfo

Web login flows, including QR-code sign-in for TikTok Web.

POST /passport/login Log in with a username or email
POST /passport/register Email registration
POST /qrcode/get Get a login QR code
POST /qrcode/check Poll a QR code for approval
POST /passport/mobile/send_code Send an SMS code

Automatic solving for slide (1105), 3D (1107) and whirl (1108) captchas.

POST /captcha/solve Solve a captcha challenge

Error responses

Failures return an HTTP 4xx status with success: false and a machine-readable code.

HTTPCodeMeaningWhat to do
401—License expired Renew your plan — the expiry is inside the key.
4014206Missing API key Add the x-api-key header.
4004404Empty request body Send valid JSON, even if it is only {}.

Python SDK

Both portals ship helper code and configuration files you can download as a zip archive.

Mobile API files Web API files
Something not covered here? Ask on Telegram and include the endpoint plus the response you received.