The TikTok Content Posting API audit, explained

What unaudited apps can do

TikTok's Content Sharing Guidelines set clear limits for apps that haven't passed the audit:

• All content posted through Direct Post is restricted to private viewing (SELF_ONLY).
• Up to 5 users can post in a 24-hour window.
• Those accounts must be set to private when posting.

To make a post public afterward, the creator switches their account to public, then changes each post's privacy to Everyone by hand. Fine for testing. Not a product.

What the audit checks

The audit checks that your app follows TikTok's Terms of Service and the Content Sharing Guidelines. Most of the guidelines describe the posting UX your app must show:

Creator info

• Fetch the creator info when the post screen loads.
• Show the creator's nickname so they know which account they are posting to.
• Stop the post if the creator can't post right now, and check video length against the creator's maximum duration.

Privacy and interactions

• Offer only the privacy levels returned for that creator, and require a manual choice with no default.
• Comment, Duet and Stitch toggles start unchecked. Grey out any the creator has disabled. Photo posts only show Allow Comment.

Commercial content disclosure

• A disclosure toggle, off by default.
• When on, the user picks Your brand, Branded content or both before publishing.
• Branded content can't be private, so the UI has to prevent that combination.

Consent and transparency

• Users agree to TikTok's Music Usage Confirmation, plus the Branded Content Policy when relevant.
• Show a preview, and send content only after explicit consent.
• Tell users processing can take a few minutes, and check status by polling or webhooks.

Caps that remain after the audit

Passing the audit doesn't remove all limits. TikTok sets a 24-hour active creator cap per app based on the usage estimate in your audit application. Each creator account also has a Direct Post cap, which TikTok describes as typically around 15 posts per day, shared across all apps. And each user token is limited to 6 publish requests per minute.

How to prepare

1. Build the full posting UI first. The audit reviews what users see, so build it before you apply.
2. Record a clean demo of the whole flow: connect, creator info, privacy pick, disclosure, consent, preview, post, status.
3. Write realistic usage estimates. They drive your active creator cap.
4. Verify the domain or URL prefix you will pull media from, or use file upload.
5. Test with your 5 private test users until every edge case works: a private account, disabled Duets, a too-long video.

Where UGC API fits

UGC API runs its own TikTok app, so you don't need your own audit to post. The tradeoff is that the creator authorizes our app, and your product has to give users the choices TikTok expects, especially privacy and disclosure. Drafts (tiktok.draft: true) are a simple way to keep the final choices in the TikTok app itself. See TikTok posting API for what we expose, and doing integrations yourself vs UGC API for the bigger decision.

For AI content disclosure, which sits next to commercial disclosure in most posting UIs, see the TikTok AI label guide.

Common reasons apps get sent back

• A privacy picker with a preselected value, often Public.
• Interaction toggles that start checked, or that ignore the creator's own settings.
• No commercial content disclosure, or a disclosure that allows private branded content.
• Posting without a preview or a clear consent step.
• A demo that doesn't match the live app.

Each of these comes straight from the guidelines, so check your UI against the current text line by line before you apply.