Creator workflow platform — manual-approval TikTok draft publishing only
Scopes: user.info.basic, video.upload
Callback: gannonwaye.com/tiktok-callback
What this platform does: Gannon Waye Music is a private creator workflow tool for the independent music artist Gannon Waye. It uses TikTok's Login Kit to securely authenticate the creator's account, and the Content Posting API to send prepared video drafts to the creator's TikTok inbox for manual review and publishing.
What this platform does NOT do: It does not auto-publish, bulk post, schedule posts, manage third-party accounts, or use any API features beyond Login Kit and the Content Posting API inbox draft endpoint.
user.info.basicThe creator clicks "Connect TikTok" which opens TikTok's official OAuth consent screen. After authorizing, TikTok redirects to the registered callback URL at gannonwaye.com/tiktok-callback with an authorization code.
Admin-only live control
The live TikTok connection button is available only inside the private admin review area. This public page documents the integration without calling protected OAuth or token-status functions.
Demo flow: admin dashboard, TikTok Platform Review, Connect TikTok, official TikTok consent, callback, connected creator status.
OAuth Flow Details
1. Clicking "Connect TikTok" opens a blank popup synchronously (direct user gesture — never blocked)
2. Backend returns TikTok OAuth URL → popup is navigated to tiktok.com/v2/auth/authorize/
3. If popup is blocked by browser → same-tab redirect fallback kicks in automatically
4. Creator completes consent; TikTok redirects to gannonwaye.com/tiktok-callback?code=…
5. Popup flow: callback stores code in localStorage → opener exchanges via action: "exchange_code"
5. Same-tab flow: callback page calls backend exchange directly → redirects back to this page
6. Token stored server-side in KnowledgeVault (service role) — never returned to browser
Login Kit: user.info.basic only — no stats, no video list
Content Posting API: video.upload only — inbox/video/init/ endpoint
No auto-publish: video always goes to creator draft inbox
Manual approval required before every upload
Only the registered creator account can connect
OAuth tokens stored server-side — never exposed to browser
Client secret in environment variables — not in source code
No Share Kit, no Webhooks, no video.publish, no video.list