TikTok Shop API Integration Guide (2026)

Short answer

The TikTok Shop API is a signed JSON API over HTTPS for the things a seller does in Seller Center: products, orders, fulfillment, returns and finance. You register in TikTok Shop Partner Center, create a custom or public app, get each shop to authorize it, and then call https://open-api.tiktokglobalshop.com with an access token in a header and an HMAC-SHA256 signature on every request. The calls are simple. The work sits around them: reviews that run to weeks for US and UK partners, a signature that breaks when your HTTP client re-serializes the body, seven-day access tokens, rate limits with no fixed published numbers, and webhooks you cannot treat as the only source of truth.

Everything below was checked against TikTok's Partner Center developer documentation on 10 November 2026. Several of these pages changed in the last two weeks, so treat timings and limits as a snapshot.

Two developer types, two app types

Partner Center asks you to pick a developer type at registration, and the choice shapes everything after it:

Seller developer. You build custom apps that read and write your own shop's data only. You need an activated TikTok Shop account first, and you register with the same email as the shop.
App developer or system integrator (ISV). You build apps that other sellers authorize. Only this type can publish public apps.

The email matters. TikTok's onboarding page warns that an address already tied to a seller account gets only the seller developer path, so an agency or software company should register with one that has never touched a shop.

Then comes the app type, described in Create your App. A public app is listed in the TikTok Shop App and Service Store after review. A custom app is not listed; you hand selected sellers an authorization link.

There are two Partner Centers: partner.us.tiktokshop.com for US accounts and partner.tiktokshop.com for everyone else. The registration region has to match your company's business certificate, and an ISV can add target markets to an existing app later.

Registration and review: plan in weeks

Creating the account and the app takes minutes. Production takes longer. The app review process page gives planning estimates, not commitments:

registration review: usually 5 business days;
app design review: usually 3 to 5 business days;
app review of a testable build: usually 7 to 10 business days;
language listing review for public apps: usually 7 to 10 business days per market or language;
data security and privacy review: about 2 weeks, with full compliance and legal review taking 3 weeks or more;
the separate US data security questionnaire: typically 10 to 12 business days;
beta testing for Connector apps aimed at US or UK sellers: usually 2 to 4 weeks.

The compliance and legal review is the long pole. It is always required for US and UK partners, and TikTok tells you to start it at registration so it runs alongside development.

A custom app is not a way around review. It needs app review if its category is Connector (an app that links TikTok Shop to an external system such as an ERP, OMS, WMS or ecommerce platform), if it reaches 25 or more seller authorizations, or if Partner Center asks for it. Separately, Partner Center may cap an app at 25 seller authorizations during beta or while a required review is pending. A seller developer's custom app for its own shop usually skips app review.

Authorization and tokens

The flow is OAuth-shaped; the authorization overview is the reference:

Send the seller to your authorization link. It starts with https://services.us.tiktokshop.com/open/authorize for US shops and https://services.tiktokshop.com/open/authorize for the rest of the world, with your service_id as a query parameter. Add a single-use state value.
After approval TikTok redirects to your redirect URL with a code. It expires in 30 minutes and works once.
Exchange it with a GET to https://auth.tiktok-shops.com/api/v2/token/get, passing app_key, app_secret, the code as auth_code, and grant_type=authorized_code.
Store the access_token and refresh_token with their expiry timestamps. The access token is valid for seven days by default; the refresh token lasts as long as the authorization the seller granted.
Refresh before expiry through /api/v2/token/refresh with grant_type=refresh_token.

Authorizations end. TikTok sends an UPCOMING_AUTHORIZATION_EXPIRATION webhook 30 days before expiry and then daily until the seller reauthorizes, and a SELLER_DEAUTHORIZATION webhook when a seller removes your app in Seller Center. Subscribe to both, and on the second stop calling that shop.

While an app is in development, live sellers cannot authorize it; you test against a Seller Center test account from Development Shops in Partner Center.

The request shape and the signature

Business endpoints follow /{category}/{version}/{resource}, for example /authorization/202309/shops or /order/202309/orders/search. Every call carries three query parameters, app_key, timestamp and sign, plus the access token in the x-tts-access-token header. Shop-level endpoints also take shop_cipher, an encrypted shop identifier you read from Get Authorized Shops and store next to the tokens.

The signature is where integrations lose their first afternoon. Per Sign your API request:

Sort all query parameters except sign and access_token by key and concatenate them as key followed by value, with no separators.
Put the request path in front of that string.
If the request is not multipart/form-data, append the body.
Wrap the result with your app secret at both ends.
Compute HMAC-SHA256 over it with the app secret as the key, and hex-encode the digest.

Two rules cause most failures. The timestamp is a 10-digit Unix time in seconds, accepted from five minutes in the past to 30 seconds in the future, so a drifting clock or a millisecond value is rejected. And you must sign the exact bytes you send: if your HTTP library re-serializes the JSON afterwards, the signature no longer matches.

Versions are named after the month of release, such as 202309, and are set per API. TikTok's versioning page says a prior version stays available for at least two months after a new one ships, and a retirement is announced in the changelog at least two months ahead. Someone has to read that changelog every month.

The core API areas

Products. The Products API creates, edits, activates, deactivates and deletes listings, as live products or drafts. Before you can create one you need the category tree, category rules and attributes, brands and warehouses, and uploaded images. The steps differ by the shop's location, and cross-border sellers work with global products that are published to each market.

Orders. You search orders with POST /order/202309/orders/search, filtering by creation or update time and paging with a token, at up to 100 orders a page. The status model in the Order API overview is the part to learn: UNPAID, ON_HOLD, AWAITING_SHIPMENT, PARTIALLY_SHIPPING, AWAITING_COLLECTION, IN_TRANSIT, DELIVERED, COMPLETED and CANCELLED. A paid order sits in ON_HOLD for a one-hour remorse period in which the buyer can cancel alone. In that hour it must not be fulfilled, and the recipient address is not returned.

Fulfillment. Orders are either fulfilled by TikTok, where the seller does nothing, or by the seller. Seller fulfillment splits into TikTok shipping, where you buy the label through the platform, and seller shipping, where you use your own carrier and report tracking back. In the US, UK, EMEA and Japan TikTok shipping means creating a package to buy the label; in Southeast Asia and Latin America you schedule a handover instead.

Returns, refunds and cancellations. A buyer cancellation after the remorse period is a request the seller reviews. Only unshipped orders can be cancelled, and partial cancellation for out-of-stock items is limited to US and UK sellers. Returns start after delivery.

Finance. The Finance API is built around statements. Each seller gets one statement a day, closed at 00:00 UTC, and each statement normally leads to one payment. You list statements, pull the order-level transactions of a statement, then the SKU-level detail of an order; a separate endpoint returns unsettled transactions. For a profit view that matches Seller Center, budget most of your time here.

Webhooks

You subscribe a shop to topics in Partner Center or through the Events API (PUT, GET and DELETE on /event/202309/webhooks). Topics cover orders, packages, products, cancellations, returns, customer messages and the two authorization events above.

The delivery contract, from the webhooks overview and its configuration guide:

The callback URL must be HTTPS on a domain name, with TLS 1.2 or later and no custom port.
Answer with HTTP 200 within 3 seconds. Anything else counts as a failed delivery.
Failed deliveries are retried after 2 minutes, 30 minutes, 3 hours and 12 hours, and TikTok stops after the fourth retry.
Delivery is at least once. Deduplicate on tts_notification_id.
The signature arrives in the Authorization header as a hex HMAC-SHA256 of your app key followed by the raw body, keyed with the app secret. Verify it on the raw body before any JSON parsing, with a constant-time comparison.

TikTok states plainly that critical state should also be reconciled by scheduled polling. Acknowledge fast, queue the event, and run a sweep on update time that catches what the webhooks missed.

Rate limits

There is no table of quotas to copy. The rate limits page describes dynamic allocation: capacity depends on how many shops have authorized your app, on the weight of the endpoint and on platform load. The isolation unit is the pair of app and authorized shop, so key your limiter the same way.

Throttling shows up as HTTP 429, as business code 36009002 in the response body, or both. Honour Retry-After when present, otherwise back off exponentially with jitter.

As starting points per app and shop, which TikTok stresses are not platform limits, it suggests 0.2 to 1 request a second for heavy writes or analytics, 1 to 3 for standard writes, 3 to 10 for standard reads and 5 to 20 for lightweight or batch reads. An endpoint's own reference page wins if it states a limit.

Regions and data handling

The regions page, last updated in July 2026, lists sixteen markets across the Americas, Europe and Asia, from the United States and the United Kingdom to Brazil, Japan and Vietnam. All use the same API and token hosts; what differs is the Partner Center, the consent domain, parts of fulfillment and the reviews.

On data location the documentation asks more than it tells. The data security and privacy review wants the countries where data is stored and processed, where staff work and how they reach production, a retention schedule and the deletion process after a seller disconnects. It sets a baseline of TLS 1.2 or later in transit and AES-128 or stronger at rest, and US apps answer a separate questionnaire. We found no public page stating a fixed residency rule per market; the review asks that your arrangements meet the requirements of your target markets. Raise storage location with your partner manager before you choose a cloud region.

Common traps

Registering with a shop email when you needed the ISV path.
Starting the compliance review after the build, not with it.
Signing a different body than the one sent, or a timestamp in milliseconds.
Ignoring the expiry and deauthorization webhooks.
Shipping an ON_HOLD order.
Trusting webhooks without a sweep.
Requesting every scope. TikTok notes that unneeded scopes lengthen review and lower the share of sellers who approve.

The Amazon side of a multichannel stack

A TikTok Shop integration rarely lives alone; the same team usually wants its Amazon numbers next to it. For that half you can have the data without a second pipeline. DataDoe, the product our team engineers, provides Seller Central, Vendor Central and Amazon Ads data in one schema over MCP, REST and BigQuery, and its platform page shows what is covered. The TikTok Shop half is the build this guide describes.

How we scope a TikTok Shop integration

Four questions settle the design: one shop or many, which markets, read-only or also writing, and whether finance must reconcile to Seller Center. Then the order is fixed: registration and compliance on day one, tokens and signing, order sync with a sweep, fulfillment, finance last.

Deltologic is an Amazon partner with an engineering team in Poland, and marketplace APIs have been our daily work since 2020. Our marketplace integrations page covers the scope, and the Walmart Marketplace API guide is the sister article to this one. If you are planning a TikTok Shop API integration, write to us with the markets and systems involved and we will come back with a plan and an estimate.

Frequently asked questions

How do I get access to the TikTok Shop API?

Create an account in TikTok Shop Partner Center, register as a seller developer (your own shop only) or as an app developer (ISV), and create a custom or public app. US and UK partners must also pass a compliance and legal review, which TikTok says can take three or more weeks.

What is the difference between a public and a custom TikTok Shop app?

A public app is listed in the TikTok Shop App and Service Store after review and sellers install it from there. A custom app is not listed and is shared by authorization link. A custom app still needs app review if it is a Connector app, reaches 25 or more seller authorizations, or Partner Center requests it.

How are TikTok Shop API requests signed?

Each request carries a sign parameter: an HMAC-SHA256 hash, keyed with the app secret, of the app secret, the request path, the sorted query parameters (without sign and access_token), the request body and the app secret again. The timestamp must be a 10-digit Unix time within five minutes of the current time.

How long do TikTok Shop access tokens last?

The access token is valid for seven days by default and is renewed with the refresh token, which lasts as long as the authorization the seller granted. The authorization code from the consent step expires after 30 minutes and can be used once.