TikTok integration
GUCupload uses TikTok's official developer APIs to publish videos to the operator's own TikTok account. This page describes exactly which scopes are requested, what each one is used for, and what happens to the data.
Scopes requested
| Scope | Why it is needed |
|---|---|
user.info.basic |
To show which TikTok account is currently connected — display name and avatar — so the operator can confirm they are about to post to the right account before approving a publish. |
video.upload |
To upload a rendered MP4 to TikTok as a draft the operator can finish in the TikTok app. Used when a post is meant to be reviewed inside TikTok itself before going live. |
video.publish |
To publish an already-approved video directly at its scheduled time. This is what makes unattended scheduled posting possible — the video was approved in the panel before it was queued. |
No other scopes are requested. The app does not read other users' content, does not access analytics, and does not act on any account other than the one that authorised it.
The publishing flow
- Authorisation The operator starts the connection from the panel and is redirected to TikTok's own authorisation page. TikTok redirects back to the app's registered callback with an authorisation code, which is exchanged server-to-server for an access token and refresh token.
- Creator info check Before an upload, the app queries the Content Posting API's creator info endpoint to read the current posting eligibility and limits, and respects them instead of guessing.
- Upload initialisation The app initialises a video post through the Content Posting API and receives an upload URL, then transfers the rendered MP4 to that URL.
- Result recorded The returned publish id and status are stored in the operator's own log so the post can be traced later. If TikTok returns an error, the item is marked failed and is not retried blindly.
Content that gets posted
Every video published through this app is produced by the operator for the operator's own channel: original script, generated narration, and rendered visuals. The app never republishes other creators' videos, never posts content it did not render, and is not used to run accounts on behalf of third parties. Each video is previewed and approved by a person before it can enter the publish queue.
Tokens and data handling
- Access and refresh tokens are stored on the operator's own server in a private volume, used only to call TikTok APIs, and refreshed through TikTok's token endpoint. They are never sent anywhere else.
- The app never asks for or stores a TikTok password. Authorisation happens entirely on TikTok's site.
- Basic profile data returned by
user.info.basicis used for on-screen display only and is not stored beyond the current session's cache. - Disconnecting in the panel deletes the stored tokens; access can also be revoked at any time from TikTok's own settings, which immediately stops all publishing.
- Video files remain on the operator's server and are only transferred to TikTok's upload endpoint.
Full details are in the privacy policy and terms.
Compliance
- Publishing goes exclusively through TikTok's documented Content Posting API — no browser automation, no scraping, no reverse-engineered endpoints.
- Posting volume is capped per day and spread across time slots; the app is not a bulk-posting tool.
- No engagement automation of any kind: no follows, likes, comments or view manipulation.
- Use of the TikTok API here follows TikTok's Developer Terms of Service and Community Guidelines.