OAuth Tokens

Get information about the currently authenticated TikTok user. Requires a valid OAuth token with an active TikTok session.

Check if a stored refresh token is still valid without consuming it. Returns metadata about the session if valid.

This is a public endpoint — no authentication required.

Exchange an authorization code or refresh token for access tokens.

For authorization_code grant:

• code: The authorization code from /oauth/complete
• redirect_uri: Must match the original redirect_uri

For refresh_token grant:

• refresh_token: A valid refresh token

Revoke an access token or refresh token (RFC 7009). This endpoint always returns success for valid client credentials, even if the token was already revoked or invalid.

Introspect a token to determine its state (RFC 7662). Returns active: true/false along with token metadata. Works for both access tokens and refresh tokens.

Get public information about an OAuth client by client_id. This endpoint is used during the authorization flow to display client information to the user before they authorize.

Does not require authentication. Does not expose sensitive information like client_secret_hash.