| name | tiktok |
| description | Drive the user's authenticated TikTok via the browser skill: feed/user/comments via the /api endpoints (signing-gated — read via page responses). Use for TikTok research as the user. |
| metadata | {"tags":"browser, tiktok, internal-api, recon, social-graph"} |
TikTok — recon plan (hardest: anti-bot signing)
Internal API: https://www.tiktok.com/api/<endpoint>/ with a large param
set plus anti-bot signing: msToken (cookie + param), X-Bogus /
_signature / X-Gnarly — generated by TikTok's obfuscated webmssdk JS.
Hand-crafting signed requests from scratch is impractical; use the page's own
signer or its own fetches.
The winning move: stay in-page, reuse TikTok's signer
Because we run inside the loaded tiktok.com page, the signing code is already
present. Two viable strategies (capture which works):
- Reuse the page's fetch path — trigger the action via the UI (scroll feed,
open a video, open comments) and read the resulting
/api/ JSON
responses from list_network_requests / a fetch-hook. Lowest-friction for
READS.
- Call the in-page signer — TikTok exposes signing via globals
(
window.byted_acrawler / the SDK's sign fn) used to build X-Bogus. If
reachable, sign your own request params in-page, then fetch. Capture the
exact global + signature param names live (they change).
Auth: cookies (sessionid, tt_csrf_token, msToken) ride same-origin; writes
need sessionid + valid signature.
Endpoints (capture live; param sets are huge + signed)
| Purpose | endpoint |
|---|
| For-You feed | /api/recommend/item_list/ |
| A user's videos | /api/post/item_list/?secUid=<…> |
| User detail | /api/user/detail/?uniqueId=<handle> |
| Comments (who/likes) | /api/comment/list/?aweme_id=<id> |
| Video detail | /api/item/detail/?itemId=<id> |
| Search | /api/search/general/full/?keyword=<q> |
| WRITE: like (digg) | /api/commit/item/digg/ |
| WRITE: follow | /api/commit/follow/user/ |
| WRITE: comment | /api/comment/publish/ |
Entity model
User{id, uniqueId(handle), secUid, nickname, followerCount} ·
Video{id(aweme_id), desc, author:User, stats:{diggCount, commentCount, shareCount, playCount}}
· Comment{user, text, diggCount}.
Capture method
Open tiktok.com → list_network_requests for /api/ → note endpoint + the
signed params (X-Bogus, msToken, _signature) + whether the response is
readable. Probe for the signer global in-page.
Actions to test (read-first; writes gated + likely blocked)
- Open a profile/video via UI → read the
/api/ responses (feed, user,
comments).
- If a signer global is reachable → try a signed read (e.g. comment/list).
- who-commented + diggCount → engagement graph.
- (gated, expect friction) digg/follow/comment — explicit confirm.
Gotchas — manage expectations
- TikTok has the strongest anti-automation of the set. Signed-request
replication is fragile + drifts; expect blocks/captchas on writes.
- Prefer read via the page's own responses / UI-driving over hand-signed
fetches. Writes: minimal, gated, accept they may fail.
- This is the one platform where DOM / UI-driving may beat the API approach.
