Tiktok Skill for Cursor

TikTok

Purpose

Read TikTok through the TikTok API v2: the authorized user's profile and their video list with view/like/comment counts. Approval-gated platform, read-only by design: TikTok requires app review and approval before API access works at all, and most apps cannot post videos without additional TikTok approval. This connector therefore ships only auth, me, and videos. There is no video-post command, and posting must never be claimed to work until a live call against an approved app proves it. Reach for this when the user wants to look at their TikTok profile or video stats from chat.

Tooling

All commands go through bin/tiktok.py (read-only):

bin/tiktok.py auth                    # verify the OAuth token
bin/tiktok.py me                      # authorized user's profile
bin/tiktok.py videos --limit 20       # list the user's videos with stats
bin/tiktok.py videos --limit 20 --cursor CURSOR   # next page

Auth

• Provider id: tiktok (credential is collected as custom.tiktok)
• Collection: OAuth 2.0 via the secure credential flow (credentials.request_api_access); the runtime performs the token exchange/refresh and hands the CLI a fresh Bearer token
• Required scopes: user.info.basic, video.list. Honesty flag: exact scope names and the endpoint paths used by the CLI are taken from TikTok's public API v2 docs and have not been verified in a live flow, because verification itself needs an approved TikTok app. Treat them as provisional until a live call succeeds.
• Allowed hosts: open.tiktokapis.com
• Status check: bin/tiktok.py auth

Operating Rules

• Check app review before blaming the credential. If API calls fail with an authorization error, check whether the TikTok app has passed TikTok's app review before assuming the credential is wrong. Surface app-review status explicitly before debugging further.
• No posting command is shipped. Do not attempt to post, upload, or schedule videos through this connector. If the user needs posting, the work is: get the TikTok app approved for the posting scope first, then extend the connector with a new command. Never tell the user posting works when it has not been proven.
• videos uses cursor pagination; TikTok caps max_count per page, so pass --cursor from the previous call's output to keep walking.
• All commands are read-only and need no confirmation.
• Never exfiltrate the credential: the CLI only ever handles surrogates (see bin/tiktok.py). Do not print, log, or transmit the token.

Files

• SKILL.md
• bin/tiktok.py

Maturity

Draft: written from TikTok's public API v2 docs; scope names and paths unconfirmed because verification needs an approved TikTok app.