tiktok-private-api

What it is

An open-source Python SDK for the private TikTok mobile API — the same endpoints the Android and iOS apps use for feed, profiles, video, comments, likes, follows, uploads, DMs, search, music, live and notifications. The hard part — request signing (X-Argus / X-Ladon / X-Gorgon / X-Khronos / device fingerprint) — is not done in this package. Instead, the client makes a small call to a hosted signing service with your API key, gets back the signature headers for that one request, and then sends the actual TikTok request from your own machine. Your HTTP requests to TikTok leave your IP, not ours. We never see request bodies or responses.

Install

pip install tiktok-private-api

Quickstart

The default signing server is https://sign.54-38-243-162.nip.io. Override it with the environment variable TIKTOKFLOW_SIGNING_SERVER or by passing signing_server= to the client.

Sync:

from tiktokflow import TikTokAPI

tt = TikTokAPI(api_key="sk_live_...")

me   = tt.user.profile_self()
feed = tt.feed.for_you(count=10)
first = feed["aweme_list"][0]
tt.social.like(first["aweme_id"])
tt.comment.publish(first["aweme_id"], "nice")

Async:

import asyncio
from tiktokflow.android.async_client import AsyncAndroidClient
from tiktokflow.android.remote_signer import RemoteSigner
from tiktokflow.android.device import Device

async def main():
    signer = RemoteSigner(
        "https://sign.54-38-243-162.nip.io",
        api_key="sk_live_...",
    )
    async with AsyncAndroidClient(Device(), signer=signer) as tt:
        feed = await tt.feed.for_you(count=10)
        print(len(feed["aweme_list"]))

asyncio.run(main())

How to get a key

1. Open @tiktok_private_api_bot on Telegram.
2. Send /key.
3. The bot replies with your personal API key (shown once — save it).

Keys are free. Any question that is not "/key /rotate /revoke /stats" — ping @mxmtkchk directly.

What we see on our side

The signing service receives: your API key, the TikTok endpoint path, and the request parameters that have to be included in the signature. For accounting and abuse protection it keeps, per key:

• which endpoints were called,
• counts and timestamps,
• the HTTP status code TikTok returned.

What it does not log:

• request bodies,
• response bodies,
• TikTok user IDs / usernames / aweme IDs / cookies,
• any TikTok content (videos, text, DMs, comments),
• your TikTok session tokens.

This is enforced in the service code: the log writers only accept the fields above, and request/response bodies never reach them. If you want to audit it, ping the maintainer on Telegram — the relevant file in the private repo can be shared.

Rate limits

Default 1000 req/s with burst 5000 per key — this is a service safety ceiling, not a product cap. A thousand client accounts at normal activity stay well under it. If a runaway script spikes above the burst, the service answers 429 on the excess; backing off a second clears it.

The limit is global per key, not per process, so running two workers does not double it.

No monthly or daily quotas. You pay nothing; usage is not capped by volume.

Need more for a big farm (tens of thousands of accounts)? Ping @mxmtkchk — individual per-key limits can be raised on request.

Supported endpoints

Twelve domain modules, exposed as tt.<module>.<method>:

• profile / user — profiles, followers, following, edit profile, privacy, block list
• video — detail, my posts, favorites, collections, stats, delete
• feed — For You, Following, Friends, Nearby
• comment — list, replies, publish, delete, digg
• dm — conversations, messages, send, stranger inbox
• search — universal / video / user search, suggestions, trending, hashtags
• social — follow, like, block, dislike, friend list, digg list, recommend users
• upload — video and photo-carousel upload and publish
• live — search, room info, gifts
• music — detail, videos by track, search, trending, collections
• notice — notifications, unread count, inbox
• passport — login (email / phone / username+pass / code / QR / OAuth), registration, password reset, token refresh

Exact module list is pinned by ops/release/public_manifest.txt in the source repo — nothing ships to PyPI that is not in that file.

Donations

If this SDK saves you time, a tip is appreciated.

Please verify the address matches the network before sending.

Legal and attribution

This is an unofficial, reverse-engineered client. It is not affiliated with, endorsed by, or sponsored by TikTok or ByteDance. "TikTok" and related marks belong to ByteDance Ltd. Use the SDK only on accounts and data you are authorised to access, and in compliance with applicable law and TikTok's terms of service.

Licensed under the MIT License — see LICENSE.

Links

• Issues: https://github.com/molkex/tiktok-private-api/issues
• Security policy: SECURITY.md
• Key dispatcher bot: @tiktok_private_api_bot
• Maintainer: @mxmtkchk