How HyPurShot uses the TikTok Content Posting and Login Kit APIs.
This page is the technical reference for the TikTok app review team. It documents the OAuth scopes HyPurShot requests, how operators connect their TikTok account, how content is published, and how data is stored, revoked, and deleted.
App overview
HyPurShot is a mobile workflow app for detailers, auto service shops, and field service professionals. Operators capture photos and short vertical video of completed jobs, organize them into projects, and optionally publish the resulting content to their connected TikTok account. We use TikTok's official APIs to authenticate creators, display profile metadata, and publish video with full creator control on every post.
Scopes requested and why
HyPurShot requests the minimum scopes needed to deliver the documented user-facing features. Every scope below maps to a concrete operator-visible feature in the product.
- Login Kit Lets operators sign in to HyPurShot using their TikTok account, or connect TikTok to an existing HyPurShot account. We do not collect TikTok passwords. OAuth 2.0 with PKCE is used; tokens are stored server-side.
- user.info.basic Used to display the connected creator's nickname and avatar in the HyPurShot Settings → Connections tab so operators can confirm which TikTok account is linked.
- user.info.profile Used to show the verified TikTok handle and a profile link in Connections, and to attribute published video to the correct creator in the operator's own activity log.
- video.publish Used by the Direct Post action in the HyPurShot composer. Operators explicitly tap "Post" after reviewing the privacy level, caption, music-usage acknowledgement, branded-content disclosure, and platform target. We never publish without an explicit user action in the same session.
- video.upload Used by the "Save to TikTok drafts" action, which uploads the prepared video to the operator's TikTok account as a draft for the creator to finalize inside the TikTok app. No public publish occurs without the creator's final action inside TikTok.
End-to-end publish flow
-
Connect TikTok account
Operator goes to Settings → Connections in HyPurShot, taps "Connect TikTok," and is redirected to TikTok's OAuth screen. They review the requested scopes and approve. TikTok returns an authorization code to our redirect URI.
-
Exchange code, store tokens server-side
Our backend exchanges the code for access and refresh tokens. Tokens are stored encrypted at rest and never exposed to the browser. Refresh tokens are used to keep the connection alive; access tokens are short-lived.
-
Compose video in HyPurShot
Operator opens a project, taps a captured video, and opens the New Post composer. The composer surfaces every required TikTok disclosure: privacy level (Public, Friends, Private), comment / duet / stitch toggles, branded-content disclosure, and music-usage acknowledgement. Defaults follow TikTok's guidance and are clearly labeled.
-
Explicit user action to publish
The operator reviews the preview and taps "Post to TikTok." Only then does our backend call the Content Posting API with the operator's stored token. There is no scheduled, automated, or background publishing.
-
Confirmation and audit
On success, the operator sees a confirmation with a link back to the TikTok video. The event is logged in our internal activity log for the operator's own review under their account.
Data handling and retention
What we store
- The operator's TikTok user ID, display name, and avatar URL (for the Connections display).
- Access and refresh tokens, encrypted at rest, scoped to the connected operator only.
- Metadata about videos the operator published from HyPurShot (timestamp, post ID, status) for the operator's own activity log.
What we do not store
- TikTok passwords. We never see them.
- Other users' TikTok content, followers, or analytics.
- Long-term copies of video files on TikTok. We hold the source video the operator captured in their HyPurShot library only.
Revocation and deletion
Operators can disconnect TikTok at any time from Settings → Connections. On disconnect, we revoke the stored tokens via TikTok's revocation endpoint and delete the cached profile metadata. If an operator deletes their HyPurShot account, all stored tokens are revoked and all TikTok-related metadata is removed within 30 days as part of account deletion.
Compliance with TikTok policy
- No background or automated publishing. Every post is the result of an explicit operator action in the HyPurShot composer.
- All required disclosures present in the composer. Branded-content toggle, music-usage acknowledgement, comment / duet / stitch privacy controls, and privacy level dropdown are all surfaced before publish.
- Minimum scopes. We request only the scopes needed for the documented user-facing features.
- Server-side token storage. Tokens never touch the browser and are encrypted at rest.
- Respect for content policies. The composer guides operators toward complying with TikTok's Community Guidelines; it does not bypass any platform-level restrictions or rate limits.
Contact for the review team
Questions about HyPurShot's TikTok integration can be sent to ronnie.purcell@gmail.com. A test account and walkthrough video can be provided on request.