Last updated November 5, 2026

Get a Client Access Token

Gets a client access token, which lets your app call TikTok APIs on its own behalf instead of on behalf of a user. Client access tokens don't require user authorization and are only used with Research API and Commercial Content API.

Call this endpoint from your server. Each request includes your client secret, which must never be exposed in client-side code.

Endpoint

HTTP URL	`https://open.tiktokapis.com/v2/oauth/token/`
HTTP method	`POST`
Scopes	`None`
Content type	`application/x-www-form-urlencoded`

Request

Send all parameters as URL-encoded form data in the request body.

Headers

Field	Type	Description	Required
`Content-Type`	`string`	The media type of the request body. Must be `application/x-www-form-urlencoded`.	Yes

Request body

Field	Type	Description	Required
`client_key`	`string`	The client key from your app's Credentials section.	Yes
`client_secret`	`string`	The client secret from your app's Credentials section.	Yes
`grant_type`	`string`	The OAuth grant type. Must be `client_credentials`.	Yes

Request example

curl --location 'https://open.tiktokapis.com/v2/oauth/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_key=CLIENT_KEY' \
--data-urlencode 'client_secret=CLIENT_SECRET' \
--data-urlencode 'grant_type=client_credentials'

Response

A successful request returns the following fields as JSON. Store the token on your server and reuse it until it expires.

Response body

Field	Type	Description
`access_token`	`string`	The client access token.
`expires_in`	`int64`	The number of seconds until the token expires. Client access tokens are valid for 2 hours (`7200` seconds).
`token_type`	`string`	The token type. Always `Bearer`.

This endpoint doesn't return a refresh token. To get a new client access token, call this endpoint again.

Response example

{
  "access_token": "clt.example12345Example12345Example",
  "expires_in": 7200,
  "token_type": "Bearer"
}

Error codes

If the request fails, the response body contains an OAuth error object. See OAuth Error Handling.

Error code	Description	Resolution
`invalid_client`	The client key or client secret is missing or incorrect.	Copy both values from your app's Credentials section and retry.
`invalid_request`	A required parameter is missing or malformed.	Check the request against the parameter tables and retry.
`server_error`	An unexpected server error occurred.	Retry with exponential backoff. If the error persists, contact support with the `log_id`.
`temporarily_unavailable`	The service is temporarily unavailable.	Retry with exponential backoff.
`unauthorized_client`	Your app isn't authorized to use this grant type.	Check that your app has access to Research API or Commercial Content API.
`unsupported_grant_type`	The `grant_type` value isn't supported.	Set `grant_type` to `client_credentials`.

Get a Client Access Token

#Endpoint

#Request

#Headers

#Request body

#Request example

#Response

#Response body

#Response example

#Error codes