TikTok and CodeWords: what the API actually allows

Most writing about automating TikTok assumes capabilities the platform does not grant, which is how teams end up building a publishing pipeline that cannot publish. TikTok's API is deliberately constrained, the constraints are about content moderation rather than technical limits, and they decide what you can build before you write anything.

So the honest version starts with what is permitted, and then covers where automation genuinely helps — which turns out to be most of the work surrounding publishing rather than publishing itself.

What we'll cover

• Direct posting versus upload to draft
• What the TikTok APIs reach
• Connecting it to CodeWords
• Seven automations worth building
• Analytics, and what the numbers mean
• The parts that should stay human
• Getting access in the first place
• Building it so it survives
• Limits worth knowing about
• What to build first
• Frequently asked questions

Direct posting versus upload to draft

The Content Posting API offers two modes, and which one your application gets is the single most important fact about your pipeline.

Upload to draft places the video in the account's TikTok inbox, where a person opens the app, reviews it, adds whatever they want, and posts. Available more readily, and it means publishing is never fully unattended.

Direct post publishes without a person in the app, and it requires your application to pass TikTok's audit. The audit exists because direct posting means content reaching the platform without human review at the point of publication.

Plan for draft mode first. Build the pipeline so a person reviews and posts, and treat direct posting as an optimisation that arrives if and when the audit passes.

Unaudited applications also face restrictions on visibility, so a video posted by an unaudited client may not be publicly viewable, which is the kind of thing best discovered in testing rather than during a launch.

Assume the review step, in other words, and the pipeline you build works either way.

What the TikTok APIs reach

Content Posting handles video and photo uploads, in the modes described above, with a status endpoint since processing is asynchronous.

Display API returns the authorised user's own videos and their basic metadata.

Creator info reports what the account is permitted to do — privacy options available, whether commercial content disclosure applies, and duration limits — and it should be read before every post rather than assumed.

Business and analytics endpoints provide account and video metrics where the account is eligible, covering views, engagement, and audience information at varying granularity.

Research and commercial content APIs exist for specific purposes with their own approval processes and are not general access.

What is not available: publishing to arbitrary accounts, reading other creators' analytics, comment moderation at any depth, or a general firehose of trending content. Anything promising those is either using a different mechanism or describing something that does not exist.

Connecting it to CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: where the video comes from, what should accompany it, and who reviews it.
3. Authorize the connection with the TikTok account, granting the scopes the workflow needs.
4. Describe the exceptions: a video that fails processing, a duration outside what the account permits, a caption over the limit.
5. Run it into drafts and check the result in the app before anything posts.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Seven automations worth building

Upload to drafts on a schedule. The video is ready and waiting in the app, so publishing becomes a thirty-second decision rather than a task requiring somebody to find the file.

Performance digests. How recent videos performed, compared against your own baseline rather than against benchmarks from elsewhere, delivered where the team works.

Cross-platform reporting. TikTok alongside your other channels in one view, since the comparison is the point and nobody assembles it by hand consistently.

Asset pipeline management. Video files from wherever they are produced, checked for duration and format, named consistently, and ready to upload without anyone hunting through a drive.

Publishing checklist enforcement. Caption length, disclosure requirements, required links, and any legal review, checked before the draft is created rather than after somebody posts.

Outlier alerting. A video performing far above or below your normal range, flagged promptly, since the response to an unexpected hit is time-sensitive.

Content calendar synchronisation. Keep the planning system and what is actually uploaded in step, so the calendar reflects reality.

Analytics, and what the numbers mean

Compare against yourself. Your own recent median is the only meaningful baseline. Industry benchmarks from content marketing blogs are not measurements of anything relevant to your account.

Give videos time. TikTok distribution is not front-loaded in the way other platforms are, and a video judged at twenty-four hours can be judged wrongly.

Watch completion and rewatch behaviour where available, since they drive distribution more directly than raw view counts.

Report distributions, not averages. Performance is heavily skewed — a handful of videos account for most of the reach — so an average describes a situation that does not exist.

Be careful with follower numbers. They move for reasons unrelated to recent content, and treating them as a scorecard leads to poor decisions.

Do not infer why something worked. The honest report says what happened. The temptation to explain it produces confident narratives that the next video disproves.

The parts that should stay human

What to make. Automation surfacing what performed is useful; automation deciding the next video is not.

The caption and the hook. These are the content, not packaging.

Responding to comments. Automated replies on TikTok read as automated immediately, and the comments are a meaningful part of how an account is perceived.

Anything trend-adjacent. Judging whether a trend suits your brand is a judgement call, and getting it wrong is publicly embarrassing in a way that is hard to undo.

The decision to post. Which is why draft mode is a reasonable constraint rather than only an obstacle.

Getting access in the first place

The application setup is a larger part of this project than the code, and it is worth knowing the shape of it before committing to a timeline.

Register an application in TikTok's developer portal, declaring what it does and which products it uses.

Request only the scopes you need. A request for broad access with a vague justification is the usual reason a review goes slowly.

Sandbox testing comes first, against accounts you control, which is where the posting modes and their restrictions become concrete rather than theoretical.

Audit is a separate step from application approval, and it is the one that gates direct posting. Treat it as a project with a lead time rather than a checkbox.

Terms constrain what you can do with the data, including retention and what may be shown to whom, which matters if you are building anything that stores metrics.

Plan for the review taking time. Build the draft-mode pipeline while the audit is pending, so the work is useful either way rather than blocked on an outcome you do not control.

Building it so it survives

Poll the status endpoint. Upload and processing are asynchronous, and a successful upload request is not a published video.

Read creator info before each post rather than caching it, since available privacy options and duration limits can change with account state.

Validate before uploading. Duration, format, aspect ratio, and caption length, checked locally, save a slow round trip and a confusing failure.

Make it idempotent. Record the publish identifier against your source asset so a retry does not produce a second upload.

Refresh tokens properly. Access tokens expire and the refresh flow is where most of these integrations break after a few weeks of working perfectly.

Limits worth knowing about

Direct posting requires audit approval, and unaudited applications are limited both in posting mode and in the visibility of what they post.

Rate limits apply per user and per application, and upload sizes and video durations are constrained by the account's own permissions.

Analytics availability depends on account type, with business accounts getting more than personal ones.

Historical data is limited. Pull metrics regularly and keep your own history rather than expecting to query far back later.

Third-party tools face the same rules. A scheduler offering direct posting has passed the audit itself; it has not found a way around it.

What to build first

The scheduled upload to drafts, with validation before it uploads. It needs no audit, it removes the step where somebody transfers a file to a phone, and it puts publishing where it belongs: a person opening the app and tapping post on something already there.

Two habits make the difference. Validate duration, format, and caption length before uploading, since a failure at that point is fast and a failure after a large upload is not. And notify whoever reviews when a draft is ready, because a draft nobody knows about is no better than a file nobody knows about.

Frequently asked questions

Can I post to TikTok fully automatically?

Only with an audited application using direct post. Without that, you upload to drafts and a person publishes from the app. Build for drafts and direct posting becomes an improvement rather than a dependency.

Why is my posted video not publicly visible?

Unaudited applications face visibility restrictions on the content they post, which is a common and confusing first experience. Check your application's audit status before assuming something is broken in your pipeline.

Can I read analytics for accounts I do not own?

No. The APIs cover the authorised account. Anything offering competitor analytics is gathering it another way, which carries its own risks and is not what these endpoints do.

How long should I wait before judging a video?

Longer than on most platforms. Distribution is not strictly front-loaded, and a video assessed at twenty-four hours is frequently assessed wrongly. Report early numbers as early numbers.

Should automation reply to comments?

No. Automated replies read as automated, and comments are a significant part of how an account is perceived. Surfacing comments that need a response is useful; writing the response is not.

Why does my integration stop working after a few weeks?

Token refresh, almost always. Access tokens expire, and a refresh flow that was never exercised during testing is the commonest failure in every social integration.

Can I schedule posts at an optimal time?

You can schedule the upload. Optimal-time advice for TikTok is largely folklore, and your own data on when your audience watches is more reliable than any general recommendation — which is a good reason to keep your own metric history.

How long does getting API access take?

Longer than the build, usually. Application registration, scope review, sandbox testing, and — for direct posting — a separate audit each take time you do not control. Build the draft-mode pipeline in parallel so the work is not blocked on the outcome.

Which scopes should I request?

Only the ones the workflow uses. Broad requests with thin justification are the common reason a review stalls, and narrowing them later is more work than starting narrow.

Can I use a third-party scheduler instead of building this?

You can, and it operates under the same platform rules — a scheduler offering direct posting has passed the audit itself rather than found a way around it. Building your own is worth it when the surrounding work (asset preparation, checks, reporting across channels) is the part costing time.

What should a performance report actually show?

Distributions rather than averages, compared against your own recent history rather than external benchmarks. Performance is heavily skewed, so an average describes a video that does not exist.

Related reading

• LinkedIn and CodeWords
• Automating YouTube uploads
• CodeWords integrations and templates