REST + OpenAPI + skill

Connect one TikTok account to your agent.

Agentic Posting handles TikTok OAuth, temporary media delivery, draft upload, immutable post review, explicit creator confirmation, and status. It does not add scheduling, other social networks, or a post-history dashboard.

Start for $8/monthRead SKILL.mdOpenAPI JSON

Machine-readable entry points

Canonical agent skillSafety rules, setup, curl examples, and recovery. OpenAPI documentAuthentication, request, response, and error contracts for the supported agent operations and browser review. OpenAI metadataAgent package display name, description, and default prompt. llms.txtCompact product contract and canonical links for language models. ai.txtShortest path from discovery to the canonical skill and schema.

Setup

  1. Sign in on the account page.
  2. Activate Creator 300 for $8/month through Polar.
  3. Connect one TikTok creator account and claim an API key.
  4. Install the skill and store the key as AGENTIC_POSTING_API_KEY.
  5. Ask the API for context and current capabilities before preparing a post.

For Codex, install the canonical skill file locally. Other agents should read the hosted SKILL.md before acting and preserve its confirmation rules.

mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills/agentic-posting"
curl -fsSL https://agenticposting.com/SKILL.md \
  -o "${CODEX_HOME:-$HOME/.codex}/skills/agentic-posting/SKILL.md"

curl https://api.agenticposting.com/v1/context \
  -H "x-api-key: $AGENTIC_POSTING_API_KEY"

curl https://api.agenticposting.com/v1/capabilities

Launch operations

Required headers and media shape

Agent routes use X-API-Key. Draft, prepare, and confirm requests also require a unique Idempotency-Key. A key is durably bound to the exact logical input and may be replayed only with that identical input for recovery; changed input returns a conflict. Upload and status requests include the workspaceId returned by GET /v1/context.

One upload reservation contains exactly one MP4 video or between 1 and 35 JPEG/WebP photos. Do not mix roles or repeat an assetId. Videos may be at most 50 MB; each photo may be at most 20 MB. A workspace may have at most 70 unexpired active assets and 1,000,000,000 active bytes across pending, uploading, and ready media. Each one-shot upload must use the reserved content type, exact Content-Length, and declared lowercase SHA-256 digest.

Creator confirmation is mandatory

Intent preparation fails closed with tiktok_creator_identity_missing if TikTok does not return a recognizable username or nickname. Never confirm a generic or missing creator identity.

An agent may prepare the intent, but it must show the creator identity, every media preview, and every submitted text field and setting. For video, title is the TikTok caption (up to 2,200 characters), description is rejected, and the video-only settings are Duet, Stitch, and videoCoverTimestampMs; omit autoAddMusic and photoCoverIndex entirely. For photo, the short title (up to 90 characters) and full description (up to 4,000 characters) are separate and both must be shown when supplied; Duet and Stitch must be false, videoCoverTimestampMs is rejected, and the photo-only settings are autoAddMusic and photoCoverIndex. Omitted photo photoCoverIndex is normalized to 0 before hashing, storage, review, and submission. The API rejects media-incompatible settings instead of silently dropping them. The creator must also see visibility, interactions, AI-generated status, auto-add music, photo cover index, video cover timestamp, the umbrella commercial-content disclosure, Your brand, Branded content, content hash, expiry, and confirmation phrase. A setting for the other media type must be shown as not applicable rather than hidden. The umbrella disclosure must equal the logical OR of the two detailed brand toggles; each value is reviewed independently. The agent must then stop and wait for a new user response. A standing instruction, the original request, silence, or an agent-generated approval is not consent.

If agent confirmation is unavailable, give the creator the signed, expiring browser reviewUrl. The creator must sign in with a member account for the same workspace. The URL token alone cannot confirm, and an API key cannot select the browser channel. The review page can confirm only that one immutable intent. Any content change requires a new intent. Never work around an unavailable capability.

Plan and platform limits

Creator 300 is $8 per month for one connected TikTok account and 300 TikTok-accepted draft or Direct Post initializations per Polar billing period. There is no rollover. TikTok's own creator-level and app-level limits still apply; an allowance does not guarantee visibility, moderation approval, or a particular daily throughput.

Uploads, prepared intents, validation failures, and idempotent retries do not consume the allowance. Accepted usage belongs to the Polar period in which TikTok accepts initialization. An ambiguous provider attempt is shown separately as reserved capacity: it is not accepted usage, but it reduces currently available capacity and remains held across a period boundary until internal provider or operator evidence reconciles it. If TikTok did not return a publish id, the agent or creator cannot release or expire that hold. There is no public reconciliation endpoint. Never create a replacement request or new idempotency key for an ambiguous result; recover and poll the existing job or intent when one is exposed.

Per-post analytics are not part of the launch promise.

AI-generated photo slideshows must use the TikTok draft/inbox path at launch because TikTok's photo Direct Post request does not carry the required AI-generated-content disclosure field. The creator completes that disclosure and publishing inside TikTok.

Billing and support

Use Manage subscription in Polar for supported invoices, payment-method updates, renewal, and cancellation; Agentic Posting does not maintain a parallel billing-admin screen. Only the configured Creator 300 product can grant access. If a verified event moves the exact stored Polar subscription to an unsupported or missing product, access fails closed to inactive/no-plan; unrelated subscription identities are audit-only. A scheduled cancellation retains publishing access only through its future paid period end. Ended, expired, revoked, past-due, and unscheduled canceled states do not grant access.

API-key labels are limited to 80 characters and 320 UTF-8 bytes. The account page lists at most 50 records: the active key and up to 49 revoked audit entries. When disconnecting TikTok, local encrypted credentials are deleted only after TikTok confirms revocation. A temporary revocation failure preserves the connection so the creator can retry.

Use support for product, privacy, deletion, or security requests. Do not include secrets or payment-card data in any field: matching submissions are rejected before storage with support_message_contains_secret. Accepted support rows are scheduled for deletion after 30 days. Intake is capped at 1,000 accepted requests globally and 10 per trusted connection source in a rolling 24-hour window, plus 30,000 rows total. Per-source admission stores only a keyed hash of the normalized Cloudflare connection address, not the raw address. A full cap or missing/malformed trusted source returns the same HTTP 429 support_capacity_reached without storing the request or returning a request id; retry later without duplicating or changing the message. Rotate any credential that was exposed. See the Privacy Policy and Terms of Service.