TikTok Content Posting API: why your posts are private until the audit

You connect a TikTok account, call the API, get a publish_id back, and the upload completes. Then you open the app and the video is visible only to you. Nothing is broken. This is how TikTok's Content Posting API is designed to work until your app passes an audit.

This guide explains the restriction, what the audit checks, and how to design your posting screen so it passes. It is based on TikTok's developer documentation as published on 6 November 2026. All the links are in the references at the end.

The restrictions on unaudited apps

According to TikTok's Content Sharing Guidelines and the Direct Post reference, an app that has not passed the Content Posting API audit is limited in three ways:

1. Every post is private. Content is restricted to SELF_ONLY viewing, whatever privacy level you ask for.
2. At most five users can post through your app in 24 hours.
3. The posting account must itself be private when it posts. If it isn't, the API returns unaudited_client_can_only_post_to_private_accounts.

These limits are there so that you can build and test against real accounts, but you can't ship to the public yet.

Two reviews, not one

People often mix these up. They are separate steps:

• App Review makes your app live and approves the products and scopes it uses, such as video.publish. The app review guidelines ask for a real website (not only a login page) with a privacy policy and terms visible without opening menus. They also ask for up to five demo videos of the full flow, recorded on the same domain as your website. Apps described as in development or for personal use are rejected, and the guidelines say the app's name should not reference social media companies.
• The Content Posting API audit is what lifts the private-only and five-user limits. It checks your integration against the content sharing guidelines, chiefly the posting screen described below.

TikTok does not publish a timeline for either.

Direct Post or draft?

The API offers two ways in, with different scopes:

The inbox route (upload video reference) is simpler because TikTok's own app collects the caption and settings. Direct Post lets you publish without the creator opening TikTok, which is what scheduling needs. That is why TikTok audits it.

What the Direct Post screen must show

The Content Sharing Guidelines set out what the screen in your app must do before it calls Direct Post. In summary:

Creator information, fetched fresh. Call query creator info every time the posting page renders. Show the creator's nickname so they know which account they are posting to. If the creator can't post right now, block posting. Enforce their max_video_post_duration_sec.

Privacy, with no default. Show a privacy dropdown built from exactly the privacy_level_options that creator info returns. The guidelines say it must have no pre-selected value; the creator picks one.

Interaction settings, off by default. Comment, Duet and Stitch toggles start unchecked. If the creator has disabled one in TikTok, show it greyed out.

Commercial content disclosure. A toggle, off by default. When it is on, the creator must choose "Your brand", "Branded content" or both, and publishing stays disabled until they do. Branded content cannot be posted privately.

Consent text above the publish button. It must say that by posting the creator agrees to TikTok's Music Usage Confirmation, and to the Branded Content Policy when branded content is selected.

User control. Show a preview of the content. Don't add watermarks or logos. Let the creator edit any text you pre-fill. Post only after they explicitly confirm. Tell them processing can take a few minutes.

Each of these is easy to get almost right, a pre-selected privacy value being the obvious example, so build the screen to the guidelines from the start rather than fixing it after a rejection.

The upload itself

Once the screen is right, the flow is four calls:

1. Query creator info: POST /v2/post/publish/creator_info/query/ (20 requests a minute per token).
2. Initialise the post: POST /v2/post/publish/video/init/ with post_info (caption, privacy, toggles, is_aigc for the AI-generated label) and source_info (6 requests a minute per token).
3. Send the video: either FILE_UPLOAD, where you PUT the bytes to the returned upload_url in chunks, or PULL_FROM_URL, where TikTok downloads it from your server.
4. Poll the status: POST /v2/post/publish/status/fetch/ until PUBLISH_COMPLETE or FAILED. TikTok also offers webhooks for these events.

From the media transfer guide:

• Chunks: 5 MB to 64 MB each; the last one can be up to 128 MB. Files under 5 MB go in one request.
• Formats: MP4 (recommended), MOV or WebM; H.264 recommended; up to 4 GB.
• Size and frame rate: 360 to 4096 pixels on each side, 23 to 60 frames per second.
• Length: up to 10 minutes through the API, but each creator's own limit (from creator info) may be shorter.
• Pull from URL: your domain or URL prefix must be verified in the developer portal first. Otherwise the request fails with url_ownership_unverified.

Practical advice

• Test against a private account until the audit passes, and tell your testers why their posts are private.
• Record the demo videos on your real domain. The domain in the video must match the website on your app.
• Store the newest refresh token every time. TikTok returns a new refresh token on each refresh (token management). Access tokens currently last 2 hours and refresh tokens 180 days, but read expires_in and refresh_expires_in from each response rather than hard-coding them.
• Plan for the daily creator limit. About 15 posts a day per creator is shared across every app the creator uses, so a scheduler should spread posts out and handle spam_risk_too_many_posts.

Where Reelspan stands

We are going through this ourselves. Reelspan's TikTok integration is built to the guidelines above, and as of 6 November 2026 our production app is in TikTok's review. Until it passes, TikTok posts sent through Reelspan are private too, and the TikTok options in the dashboard say so. We will update this page when that changes.

If you post the same video to other networks too, our guide to cross-posting covers what changes per platform, and the YouTube quota guide covers Google's side.