poster.llokqIntegration
Publishing to TikTok
poster.llokq publishes your own videos to your own TikTok account, on a schedule you set, from your own machine. This page is the whole of what it does with your TikTok account, written out.
Status. The integration is complete and works in TikTok's sandbox. Production access is under review by TikTok. Until an app clears that review, every post it makes is private to the creator, whatever they chose.
Connecting your account
Running poster tiktok auth opens TikTok's own authorization page in your browser. You sign in to TikTok, not to us, and TikTok shows you exactly which permissions are being asked for.
The exchange uses the Authorization Code flow with PKCE (S256). The redirect goes to a listener on localhost on your own machine, which exists for the seconds the sign-in takes and then stops. There is no server of ours in the flow, and at no point does a credential of yours pass through infrastructure we control.
The resulting access and refresh tokens are written to ~/.poster/accounts.json on your disk, readable only by your user account.
The permissions it asks for
| Scope | Why it is needed |
|---|---|
user.info.basic |
To tie the token to the account that granted it, and to read the posting options TikTok allows that account: which privacy levels are available, and whether comments, Duet and Stitch are permitted. No profile information is read, kept or displayed beyond the account identifier and the handle you are posting as. |
video.publish |
To post a video you have queued and approved, through TikTok's Direct Post endpoint. |
video.upload |
Included automatically alongside video.publish. Unused. |
The consent screen
Every TikTok post gets its own consent screen before anything is sent. It is built from what TikTok reports for your account at that moment, not from a config file, and it runs once per post. Consent for one post never carries to another.
What it asks, in order:
-
The account and the file
Which handle this would post as, and which video file. If either changes, previously recorded consent no longer applies and the post returns to
NEEDS_CONSENT. -
Does this promote a brand, product or service?
If yes, it asks the two questions TikTok treats separately: your own brand (
brand_organic_toggle) and branded content, meaning a paid partnership (brand_content_toggle). -
Who can see this post
Chosen from exactly the privacy levels
creator_inforeturned for your account, with nothing pre-selected. You pick one every time. Branded content cannot be posted privately, and the screen refuses that combination rather than quietly changing your answer. -
Comments, Duet and Stitch
Each asked separately, and each offered only where TikTok says your account allows it.
-
The declaration, then a typed confirmation
The screen shows "By posting, you agree to TikTok's Music Usage Confirmation", or, when branded content is disclosed, "By posting, you agree to TikTok's Branded Content Policy and Music Usage Confirmation". Nothing is sent to TikTok until you confirm.
What the scheduler can and cannot do
The scheduler is unattended: it runs when your machine is on and a post is due. It selects only posts in SCHEDULED. A TikTok post with no recorded consent sits in NEEDS_CONSENT and is never selected, so an automated run cannot publish something you did not answer for, and cannot derive a privacy level or a disclosure from any file on disk.
When a post does publish, it goes through Direct Post: initialise, upload the file, then poll TikTok for the outcome, which is recorded against the post along with TikTok's own ID for it.
What we never receive
- Your TikTok password. You sign in on TikTok's own pages.
- Your videos or captions. They are read from your disk and sent to TikTok by your machine.
- Your tokens. They are written to your disk and used from there.
- Your followers, your analytics, your inbox, or anyone else's content. Those are not in the scopes and not in the code.
LLOKQ LTD operates no server that takes part in publishing, so there is no copy of any of the above on our side to disclose, sell, retain or lose.
Disconnecting and deletion
- In TikTok: Settings and privacy → Security and permissions → Manage app permissions, and remove the app. That invalidates the tokens immediately.
- On your machine:
poster tiktok remove <handle>deletes the stored tokens for that account. Deleting~/.poster/removes every stored credential. - Posts already published stay on TikTok, under your control, and are deleted from TikTok like any other post.
There is nothing to request from us, because there is nothing held by us. The privacy policy sets this out formally.
Not affiliated with TikTok
poster.llokq is made by LLOKQ LTD and is not made by, endorsed by or affiliated with TikTok or ByteDance. "TikTok" is a trademark of its owner and is used here only to say which service the app works with. Your use of TikTok is governed by TikTok's own terms, and posting through this app does not change them.
Questions about this integration: hello@llokq.com.