TikTok API Authentication: bearer tokens

Bearer tokens

Every request must carry a bearer token in the Authorization header:

http

Authorization: Bearer tkf_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

No query-string auth, no basic auth, no cookies. Cookies are deliberately ignored on the API host so cross-site requests cannot pick up a logged-in browser session by accident.

Token format

Tokens are 41 characters total: a fixed tkf_live_ prefix followed by 32 random alphanumerics. The first 13 characters (tkf_live_xxxx) are stored as the key's display prefix so you can recognize a key in the portal without ever seeing its full value again.

We never see the full token after creation

Only the SHA-256 digest is stored. If you lose the token, generate a new one and revoke the old.

Revoking a key

Open API keys, click Revoke, confirm. The key stops authenticating on the next request — no propagation delay.

Rate limits

These limits run in parallel and are independent of credit consumption. They apply on developers.tokfluence.com, which serves both /v1 and /mcp:

120 requests / minute / API key, shared across every /v1 and /mcp endpoint.
600 requests / minute / IP — guards against runaway clients.
30 requests / minute / IP for requests with no bearer token.

When throttled you get 429 rate_limited with a Retry-After header in seconds. Back off and resume.