Last updated November 2, 2026

Get a User Access Token

Exchanges an authorization code for a user access token and refresh token. Call this endpoint from your server after your redirect URI receives the authorization code.

Endpoint

HTTP URL	`https://open.tiktokapis.com/v2/oauth/token/`
HTTP method	`POST`
Scopes	`None`
Content type	`application/x-www-form-urlencoded`

Request

Send all parameters as URL-encoded form data in the request body.

Headers

Field	Type	Description	Required
`Content-Type`	`string`	The media type of the request body. Must be `application/x-www-form-urlencoded`.	Yes

Request body

Field	Type	Description	Required
`client_key`	`string`	The client key from your app's App credentials section.	Yes
`client_secret`	`string`	The client secret from your app's App credentials section.	Yes
`code`	`string`	The URL-decoded authorization code from the web, iOS, Android, or desktop authorization callback.	Yes
`grant_type`	`string`	The OAuth grant type. Must be `authorization_code`.	Yes
`redirect_uri`	`string`	The redirect URI from the authorization request. Must exactly match that value.	Yes
`code_verifier`	`string`	Required for mobile and desktop apps. The PKCE code verifier you used to generate the code challenge in the authorization request.	Conditional

Request example

curl --location --request POST 'https://open.tiktokapis.com/v2/oauth/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cache-Control: no-cache' \
--data-urlencode 'client_key=CLIENT_KEY' \
--data-urlencode 'client_secret=CLIENT_SECRET' \
--data-urlencode 'code=CODE' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'redirect_uri=REDIRECT_URI'

For mobile and desktop apps, also pass --data-urlencode 'code_verifier=CODE_VERIFIER', where CODE_VERIFIER is the code verifier from the authorization request.

Response

A successful request returns the following fields as JSON. Store them on your server.

Response body

Field	Type	Description
`access_token`	`string`	The access token for API calls on behalf of the user.
`expires_in`	`int64`	The number of seconds until the access token expires. The access token is valid for 2 hours after initial issuance.
`refresh_token`	`string`	The token for getting a new access token.
`refresh_expires_in`	`int64`	The number of seconds until the refresh token expires. The refresh token is valid for 180 days after the initial issuance. Refresh tokens are rotated: a successful refresh request returns a new `refresh_token` in place of the one you sent, immediately invalidating the previous token.
`open_id`	`string`	The TikTok user's unique identifier.
`scope`	`string`	A comma-separated list of the scopes the user authorized.
`token_type`	`string`	The token type. Always `Bearer`.

Make sure to store these values on your backend as they are needed to persist access.

Response example

If the request is successful, the response will look like the following.

{
    "error": "invalid_request",
    "error_description": "Redirect_uri is not matched with the uri when requesting code.",
    "log_id": "202206221854370101130062072500FFA2"
}

If the request is not successful, an error response body will be returned, like the following.

{
    "error": "invalid_request",
    "error_description": "Redirect_uri is not matched with the uri when requesting code.",
    "log_id": "202206221854370101130062072500FFA2"
}

Get a User Access Token

#Endpoint

#Request

#Headers

#Request body

#Request example

#Response

#Response body

#Response example