A user access token lets your app call TikTok APIs on behalf of a TikTok user who has authorized your app. Your server gets the token from an authorization code, refreshes it before it expires, and revokes it when the user disconnects your app.

For the endpoints, see Get a User Access Token, Refresh a User Access Token, and Revoke a User Access Token.

#Token lifecycle

A user access token moves through the following stages:

1. Get: After the user authorizes your app, your redirect URI receives an authorization code. Your server exchanges the code for an access token and a refresh token.
2. Refresh: Before the access token expires, your server uses the refresh token to get a new access token. The user does not need to authorize your app again.
3. Revoke: When the user disconnects your app, your server revokes the access token.

#Token lifetimes

The following table lists how long each token is valid after it is issued:

Both fields return the remaining lifetime in seconds. Use them to schedule refreshes rather than hard-coding the lifetimes.

#Refresh token rotation

A refresh request will return a different refresh_token from the one you sent. Replace your stored refresh token with the returned value every time you refresh.

#Token storage

Call the token endpoints from your server, not from client-side code. Each request includes your client secret, which must never be exposed to users.

Store the following values on your server for each user:

• access_token
• refresh_token
• open_id
• scope
• The expiry times calculated from expires_in and refresh_expires_in

#Next steps

• Get a User Access Token
• Refresh a User Access Token
• Revoke a User Access Token
• OAuth Error Handling