Home › How it works
How it works
The full path from a video sitting in a library to a post on your TikTok account — including exactly where your authorisation is checked.
1 · Authorisation
You click Sign in with TikTok. We send you to TikTok's own authorisation screen with a one-time anti-forgery token. TikTok — not us — asks for your credentials and lists the permissions. We never see your password.
2 · Token exchange
TikTok redirects back to
louhichi.tn/tiktok-auth/callback.php with a short-lived code. Our server
checks the anti-forgery token matches, then exchanges the code for an access token
over a server-to-server call.
3 · Library & approval
Short videos are added to your library with their caption and category. Each one is reviewed against the content policy and marked approved. An unapproved video is never a candidate for publishing.
4 · Scheduled publishing
At the slots you configured, the next approved video is sent to the Content Posting API with your token. The result — published or failed — is recorded and shown on your dashboard.
What you see once it's connected
The dashboard is deliberately small: who is connected, how the account is doing, and what has actually been published. Every number on it comes from a TikTok API call made with your token.
- Profile card — display name and avatar, from
user.info.basic - Four counters — from
user.info.stats - Video grid with views and likes — from
video.list - Each tile links to the real post on TikTok
Which scope powers which step
If a scope is not on this list, we do not request it.
| TikTok scope | Status | What it gives us |
|---|---|---|
user.info.basic | Granted | Your open ID, display name and avatar — so the dashboard can show which account is connected. |
user.info.stats | Granted | Your public counters: followers, following, likes and number of videos. |
video.list | Granted | The list of videos already published on your account, with their public view and like counts. |
video.publish | Requested | Write access used to publish the short videos you approved. This is what the automated publishing depends on. |
Revoking access
In the TikTok app: Settings and privacy → Security and permissions → Manage app permissions, then remove Louhichi. From that moment the token we hold is rejected by TikTok: we can no longer read your profile or publish anything. Nothing on your account is deleted — the videos already published stay yours.
Deleting your data
Revoking stops all processing immediately. To also have the stored tokens and profile data erased from our server, send one email — it is done within 30 days and we confirm in writing.