Can an unaudited TikTok app post publicly through the Content Posting API?

No — every post from an unaudited client is forced to SELF_ONLY (private) visibility regardless of what privacy level the request specifies, and the client is capped at up to 5 users posting within a 24-hour window until it passes TikTok's audit.

How long does TikTok's Content Posting API audit take?

TikTok does not publish a turnaround time anywhere in its Content Posting API documentation — plan for an unpredictable review period rather than a stated SLA.

Can a scheduling app default a post to public visibility on TikTok?

No — TikTok's guidelines require the available privacy_level options to be fetched per-video from the creator_info endpoint and shown with no default pre-selected, so the user has to actively choose the visibility rather than the app assuming one.

What is TikTok's rate limit for posting through the Content Posting API?

Each user access_token is limited to 6 requests per minute on the direct-post endpoint; exceeding the overall limit returns a rate_limit_exceeded error (HTTP 429).

What does TikTok require before a third-party app can send content to be posted?

Express user consent before any content material is sent, a preview of the exact content about to be posted, and a declaration checkbox whose exact wording depends on whether promotional or branded-content disclosure toggles are checked.

How does a post get marked as AI-generated through the API?

Via the is_aigc field on the Direct Post request, which automatically adds a "Creator labeled as AI-generated" tag to the published content.

TikTok Content Posting API: audit and privacy rules

All guides

By The SkedCast Team · Updated 23 September 2026 · 7 min read

Key takeaways

An unaudited API client has every post forced to SELF_ONLY (private) visibility "regardless of the privacy_level value sent" in the request, and is capped at up to 5 users posting within any 24-hour window.
Lifting both restrictions requires TikTok to audit the client for Terms-of-Service compliance — no turnaround time is published anywhere in TikTok's documentation.
Available privacy_level options must be fetched per-video from the creator_info endpoint and presented with no pre-selected default — the user must actively choose one.
The direct-post endpoint rate-limits each user access_token to 6 requests per minute.

TikTok Content Posting API: the unaudited-client restriction

Every post made through an unaudited API client is forced to SELF_ONLY (private) viewing, regardless of what privacy_level value the request actually sends — TikTok's guidelines state this applies "regardless of the privacy_level value sent." Unaudited clients are additionally capped at up to 5 users posting within any 24-hour window, and every account used must already be private at the time of posting.

Lifting either restriction requires TikTok to audit the client for compliance with its Terms of Service. No turnaround time for that audit is published anywhere in TikTok's Content Posting API documentation.

Privacy levels and how they must be presented

The four privacy_level values are PUBLIC_TO_EVERYONE, MUTUAL_FOLLOW_FRIENDS, FOLLOWER_OF_CREATOR, and SELF_ONLY. TikTok's guidelines require that the SET of options actually offered to a user be fetched dynamically, per video, from the creator_info endpoint's privacy_level_options field, and presented with no default pre-selected — the person posting must actively choose one rather than a scheduler silently assuming public visibility. Branded-content posts have an additional rule layered on top: they cannot be set to SELF_ONLY at all.

Rate limits and the required posting-screen consent flow

The direct-post endpoint limits each user access_token to 6 requests per minute; exceeding the overall limit returns a rate_limit_exceeded error (HTTP 429).

Before any content material is sent to TikTok, the guidelines require express user consent — content material may only start uploading after the user has actively consented — plus a preview of the exact content about to be posted and a declaration checkbox whose wording changes with the disclosure state: a default music-usage confirmation, an added "will be labeled as Promotional content" notice when a "Your Brand" toggle is checked, and a "Branded Content Policy" reference when a "Branded Content" toggle is checked (the two toggles can be combined). The user also needs to be told that processing can take a few minutes after posting.

Disclosure fields exposed on the publish call

Three disclosure fields are documented on the Direct Post reference: brand_content_toggle (third-party paid promotion), brand_organic_toggle (promoting the poster's own business), and is_aigc (marks the content as AI-generated, which auto-adds a "Creator labeled as AI-generated" tag). A distinct, separately-toggled "AI-generated content disclosure" UI element beyond is_aigc was not found documented on this specific API reference — treat is_aigc as the confirmed mechanism.

tiktoktiktok apidevelopercontent posting api

FAQ

Can an unaudited TikTok app post publicly through the Content Posting API?: No — every post from an unaudited client is forced to SELF_ONLY (private) visibility regardless of what privacy level the request specifies, and the client is capped at up to 5 users posting within a 24-hour window until it passes TikTok's audit.
How long does TikTok's Content Posting API audit take?: TikTok does not publish a turnaround time anywhere in its Content Posting API documentation — plan for an unpredictable review period rather than a stated SLA.
Can a scheduling app default a post to public visibility on TikTok?: No — TikTok's guidelines require the available privacy_level options to be fetched per-video from the creator_info endpoint and shown with no default pre-selected, so the user has to actively choose the visibility rather than the app assuming one.
What is TikTok's rate limit for posting through the Content Posting API?: Each user access_token is limited to 6 requests per minute on the direct-post endpoint; exceeding the overall limit returns a rate_limit_exceeded error (HTTP 429).
What does TikTok require before a third-party app can send content to be posted?: Express user consent before any content material is sent, a preview of the exact content about to be posted, and a declaration checkbox whose exact wording depends on whether promotional or branded-content disclosure toggles are checked.
How does a post get marked as AI-generated through the API?: Via the is_aigc field on the Direct Post request, which automatically adds a "Creator labeled as AI-generated" tag to the published content.