Strapi plugin TikTok Auth Mobile

TikTok Auth Mobile helps you to create TikTok authentication for your Android and iOS users.

It uses the official TikTok API get-user-info to get the user profile and create a Strapi user based on that information.

NOTE: Since an email is required to create a user in Strapi, this plugin creates a pseudo-email like ${user.union_id}@tiktok.com for users who logged in/registered using this plugin.

How it works

TikTok Authentication happens on the device via the Continue with TikTok button and then the client application should send access_token to the server.

Because TikTok does not expose a publicly available JWKS (JSON Web Key Set) URL in the same way that authentication providers like Google or Apple do, this plugin is not able to validate received token. Instead of token validation plugin uses this token to fetch user info from TikTok official API get-user-info.

If TikTok API returns a user user for provided access_token, then a Strapi user will be created.

If the user is already in the database, an authenticated session for the user is established.

More info can be found here: https://developers.tiktok.com/doc/login-kit-manage-user-access-tokens/

Features

• Ability to authenticate users via mobile devices using TikTok API
• JWT Authentication for users using Strapi default user-permission collection
• Secure

Activate the Plugin

Add the following in config/plugins.js of you Strapi application:

1module.exports = {
2  'tiktok-auth-mobile': {
3    enabled: true
4  },
5};

Configuration

1. Create a TikTok app from the TikTok developers portal.

2. Select Platforms: Android and iOS, configure required options for both platforms

3. Add Login Kit Product and set Redirect URI to both platforms.

4. Add user.info.profile into Scopes.

5. If you are using sandbox mode, then add a TikTok user account into Sandbox settings -> Target Users.

How to use

Authenticate User

The client retrieves a TikTok access_token when the user selects a TikTok Account.

After a user successfully signs in, send the user's access_token to your server using HTTPS. Then, on the server, we fetch the user profile information and use this information to establish a session (issue a JWT) or create a new account.

1    {
2        method: 'POST',
3        path: 'YOUR_STRAPI_BACKEND_URL/api/tiktok-auth-mobile/connect',
4        data: {
5          access_token: TOKEN
6        }
7    }

The example response:

1{
2    "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NCwiaWF0IjoxNzUzMDc5Njk2LCJleHAiOjE3NTU2NzE2OTZ9.KhfAmvlGnx_ghWRBzKvvBn70gdpfgeG-bHMFe1XsLik",
3    "user": {
4        "id": 4,
5        "documentId": "z6249d07b3m9oexz7f9u0ntd",
6        "username": "user1262767453070",
7        "email": "0cc3832e-4f61-5958-89b5-8bb8ae9b6225@tiktok.com",
8        "provider": "tiktok",
9        "confirmed": true,
10        "blocked": false,
11        "createdAt": "2025-07-21T06:34:56.292Z",
12        "updatedAt": "2025-07-21T06:34:56.292Z",
13        "publishedAt": "2025-07-21T06:34:56.293Z"
14    }
15}

If the TikTok user does not exist, an error will be returned:

1{
2    "data": null,
3    "error": {
4        "status": 400,
5        "name": "ApplicationError",
6        "message": "User does not exist.",
7        "details": {}
8    }
9}

If the TikTok API rejects the access_token, an error will be returned:

1{
2    "data": null,
3    "error": {
4        "status": 400,
5        "name": "ApplicationError",
6        "message": "Failed to fetch TikTok user: Request failed with status code 401",
7        "details": {}
8    }
9}

If the TikTok API returns some error, an error will be returned: See: https://developers.tiktok.com/doc/tiktok-api-v2-get-user-info#response (error: Error Object)

1{
2    "data": null,
3    "error": {
4        "status": 400,
5        "name": "ApplicationError",
6        "message": "Some error description from TikTok API",
7        "details": {}
8    }
9}

Report Bugs/Issues

Any bugs/issues you may face can be submitted as issues in the Github repo.