The TikTok Business Messaging API: Two Grants, Not One

Most integration problems on TikTok are not bugs. They are a permission model that looks like one connection and is really two, failing quietly in the half nobody checked.

An account authorises once and starts replying to comments within minutes, which feels like success. The direct-message half needs a second, separate grant, and until it is completed every DM step in every flow does nothing at all – no error surfaced to the person who commented, no obvious failure in the dashboard, just a branch that never fires.

This page is the layer underneath the rest of the cluster: which grant carries which scope, what actually arrives on a webhook, how to tell a half-connected account from a working one, and which limits belong to TikTok rather than to any tool. The non-technical version of the same story is in our guide to TikTok auto replies, and the build itself is in TikTok comment to DM.

Key Takeaways

Two Grants, and Why That Matters

The single most useful thing to understand before integrating anything.

Login Kit Comes First

The first authorisation is Login Kit. It carries the comment scopes – comment.list and comment.list.manage – along with profile and video access. With that alone an integration can read the comments under your posts and reply to them publicly.

For a lot of accounts this is already the useful half. Comment automation is the mechanic that works best on TikTok anyway, so a connection that stops here still does real work – which layer of tool you actually need is the subject of our TikTok DM automation guide.

Business Messaging Is Separate

Direct messages need a second grant entirely: a Business Messaging authorisation carrying the message.* scopes. Receiving a message and sending one are distinct capabilities behind it.

Nothing about completing the first step implies the second. They are separate consent screens, granted at different times, and an account can sit indefinitely with one and not the other.

The Failure Is Silent

This is the part worth designing around. A flow whose trigger is a comment and whose action is a DM will fire the trigger, match the keyword, and then do nothing – because the send has no permission behind it. The commenter sees no error. The campaign looks active.

If comment replies work and DMs never arrive, check the second grant before checking anything else. It is the first thing to suspect and it is almost always the answer.

Reading a Connection Honestly

Four booleans, and they are worth more than the word “connected”.

The Capability Snapshot

A properly built integration exposes what an account can actually do rather than whether a token exists. Four flags carry it: whether public comment replies are available, whether direct messages can be received, whether they can be sent, and whether comment-to-message is available.

Those four answer every “why is this not working” question on this platform, and they answer it before anybody reads a log.

Status Is Not Capability

An account also carries a lifecycle status – active, inactive, disconnected or deleted – and only an active one runs campaigns. That is a different question from what the active account is permitted to do.

Both need checking. An active account missing the messaging grant and a disconnected account look identical from the outside: nothing happens.

Tokens Expire, Quietly

TikTok tokens are refreshed on a schedule ahead of expiry rather than when a call fails. Where that refresh is missing or has stopped, the symptom is the same silent nothing – which is the recurring theme of this platform and the reason monitoring matters more here than on channels that return a loud error. TikTok’s own account and privacy controls, which sit upstream of all of this, are documented in its help centre.

Which Grant Carries What

The map most integration guides leave out.

The capability differences across the other channels we support are set out in our comparison of DM apps.

What Arrives, and How

Events, not polling – which changes how you think about reliability.

Comment Events Are Pushed

Comment automation runs on TikTok’s COMMENT webhooks: TikTok posts the event to a callback URL you register, and the integration acts on it. There is no polling loop and no interval to tune.

The practical consequence is that your callback has to be reachable and fast. An endpoint that is slow or intermittently down does not queue politely – it loses events, and a lost comment event is an automation that simply did not happen.

Signed, and Worth Verifying

Inbound webhooks carry a signature header, and verifying it is not optional. An unverified public endpoint that triggers outbound messages is an invitation to have your account send whatever a stranger posts to it – the same exposure that makes unsolicited mass DM a bad idea, arriving from the other direction.

Any integration worth connecting verifies the signature before acting. If you are building rather than buying, this is the first thing to get right and the easiest to skip.

Three Values You Register

An app id, an app secret and the webhook callback URL, registered on TikTok’s developer portal. That is the whole configuration surface, and it is worth noting how small it is: almost everything else that varies between integrations is a product decision rather than a platform one.

Ceilings That Belong to TikTok

Worth knowing before you design around a number that cannot move.

Four Hard Limits

A forty-eight hour window to reply to someone who messaged. A maximum of ten consecutive outbound messages. A maximum of three public reply steps in one campaign. And a message length TikTok enforces rather than suggests.

All four are platform limits. A tool can surface them, warn you before you hit them, or hide them until you do – but none can raise them, and a vendor implying otherwise is describing something they cannot deliver.

What the API Does Not Expose at All

There is no product catalogue on this channel, so a send that works on WhatsApp or Instagram has no TikTok equivalent. There is no follower gate. And TikTok Shop and TikTok Live are separate surfaces that comment and DM automation does not reach.

None of those are gaps in a particular tool. They are the shape of what TikTok exposes, and the honest version of a comparison table says so. The catalogue sends that do exist elsewhere are covered in our WhatsApp automation guide, and the comparable per-channel ceilings in our guide to Instagram DM limits.

Build or Buy

A fair question, and the answer depends on one thing more than the rest.

What You Would Be Building

Two OAuth flows and their refresh cycles, a signature-verified public endpoint, retry and idempotency for events that arrive twice, keyword matching with sensible modes, per-recipient throttling so you do not walk into the consecutive-message cap, and a view of the four capability flags so support can answer “why is nothing happening”.

None of it is hard. All of it is maintenance, and the platform changes underneath it.

The Question That Decides It

Whether TikTok is the only channel you will ever automate. If it is, building is defensible. If Instagram, WhatsApp or Messenger are coming, you are not building a TikTok integration – you are starting a multi-channel one, and each channel has its own permission model, its own windows and its own silent failures.

That is the point at which most teams stop building. The comparison of what differs per channel is in our DM marketing guide.

Connecting It Properly

Six steps. The second is the one that gets skipped and causes the rest.

Comment scopes plus profile and video. Comment replies will start working, which is encouraging and incomplete.

A separate consent screen for the message scopes. Until this is done every DM step is a no-op that reports nothing.

Comment reply, receive DM, send DM, comment-to-DM. All four should be true before you build a flow that depends on them.

Signature verification before any action. An unverified endpoint that sends messages is a liability, not a shortcut.

Comment on your own video from a second account and confirm the message arrives. Testing only the public reply is how the gap survives to production.

This platform fails quietly. Alert on ‘no events for N hours’ rather than waiting for an exception that will not come.

Symptom to Cause

The four things that actually go wrong, and where to look first.

Keyword match modes and trigger scope are covered properly in the comment-to-DM guide.

How DMpro Connects TikTok

DMpro walks both authorisations – Login Kit for the comment scopes, then the Business Messaging grant for the message scopes – and exposes what the account can actually do afterwards rather than a single connected badge. Comment events arrive on signature-verified webhooks, and tokens refresh ahead of expiry.

The ceilings are TikTok’s and are surfaced rather than worked around: the forty-eight hour window, ten consecutive outbound messages, three public reply steps, and the message length TikTok enforces.

• Both OAuth grants, with the second one prompted rather than assumed
• Capability flags for comment reply, send DM, receive DM and comment-to-DM
• Signature-verified comment webhooks
• Scheduled token refresh ahead of expiry
• Keyword match modes: word, contains, exact
• Per-recipient cooldowns that keep you inside the consecutive cap

Conclusion

The TikTok messaging API is small, and the one thing that catches everybody is that it is split. Login Kit gets you comments; a separate Business Messaging grant gets you direct messages; and the gap between them produces a flow that triggers correctly and then does nothing, with no error anywhere.

So read capabilities rather than connection state. Four booleans – comment reply, receive, send, comment-to-DM – answer almost every support question on this channel before anyone opens a log.

And treat the ceilings as fixed, because they are. Forty-eight hours, ten consecutive messages, three public reply steps, an enforced length, no catalogue and no follower gate. Designing inside them is quick. Designing around them is work that cannot succeed.

Frequently Asked Questions