TikTok integration
Product: Agent City Studio (website: https://studio.agentcitydigital.com). Redirect URI registered with TikTok: https://studio.agentcitydigital.com/auth/tiktok/callback.
Products and scopes requested
| Product / scope | Why it is needed |
|---|---|
Login Kit - user.info.basic | To show the owner which TikTok account is connected (display name and avatar) and to bind the connection to that account's open id, so a video can never be sent to a different account by mistake. |
Content Posting API - video.publish (Direct Post, FILE_UPLOAD) | To upload one of the owner's own videos from their library to the owner's own TikTok account after the owner approves it. Agent City queries the creator's allowed privacy options first and uses only those; while the app is unaudited it uses the private option only. |
No other scope is requested. Drafts (video.upload) are not used.
Data handling
- Stored: the connected account's open id, display name and avatar address; the granted scopes; the access and refresh tokens (encrypted, on the owner's own computer); for each post the TikTok publish id and its status.
- Not stored on this website: this site keeps no database, cookie, log or file. It forwards the sign-in return to the owner's private system.
- Not done: no sale or sharing of TikTok data, no profiling, no advertising, no reading of the account's videos, followers or messages.
- Control: the owner disconnects in the app, which revokes the token at TikTok and deletes the stored tokens.
How a reviewer sees the flow
- The owner opens the private Agent City console and presses Connect TikTok; TikTok asks for the two scopes above.
- TikTok returns to the redirect URI on this site, which forwards the browser to the private system; the connected account is shown.
- The owner chooses an original video from the library, previews it, writes the caption, and approves the post.
- Agent City uploads the file to TikTok, tracks the status until TikTok reports it, and records the TikTok post id.
A screen recording of exactly this flow is provided with the review request. The private console is not exposed to the internet, which is why the flow is shown by recording.