Most sellers connect TikTok Shop to other systems through ready-made apps and integrations. But brands with custom ERPs, warehouse systems or reporting needs sometimes build their own connections using the TikTok Shop Open API. The API lets approved software read and update shop data, such as products, stock, orders and shipping, without anyone clicking through Seller Center.
This guide gives sellers and their developers a plain-language overview of how the Open API generally works. It is not a replacement for the official documentation, which defines exact endpoints, versions, fields and rules. TikTok updates the API regularly, so always build from the current docs in the TikTok Shop partner or developer portal for your market.
When a Custom API Integration Makes Sense
- You run a custom ERP or warehouse system with no ready-made connector.
- You need real-time stock sync across several channels with custom rules.
- You want automated reporting combined with data from other systems.
- You manage many shops or markets and need central control.
- You are a software company building an app for many sellers.
If an existing app already does what you need, using it is usually faster and cheaper than building. See our guides to Shopify integration and order management systems.
Partner Portal and App Registration
API access usually starts in the TikTok Shop partner or developer portal. A developer registers as a partner, creates an app, chooses the markets and API scopes the app needs and submits it for review where required. The app receives credentials, typically an app key and an app secret. Keep the secret private: store it in a secure server-side configuration, never in front-end code, public repositories or shared documents.
Authorisation: How a Shop Grants Access
An app cannot read a shop's data until the shop authorises it. The usual flow is OAuth-style: the seller opens an authorisation link, logs in to their seller account, reviews the permissions requested and approves. The app then receives an authorisation code, which it exchanges for an access token and a refresh token. The access token is used for API calls and expires after a set period; the refresh token is used to obtain a new access token without asking the seller again.
Build token refresh into your app from day one. Many integrations break weeks after launch simply because tokens expired and nobody refreshed them.
Signing Requests
API requests typically need to be signed. The app combines request details, such as the path, parameters and a timestamp, with its secret to create a signature, following the exact algorithm in the docs. The server checks the signature to confirm the request is genuine and unchanged. Signature errors are among the most common problems when starting out; follow the documented order of parameters and encoding precisely, and use official SDKs or examples where available.
Key API Areas
Exact names differ by version, but the API commonly covers:
- Shop and authorisation: details of authorised shops.
- Products: creating, updating and reading listings, categories, attributes, images, prices and stock.
- Orders: listing and reading orders, statuses and details.
- Fulfillment and logistics: shipping packages, labels, tracking and warehouses.
- Returns and refunds: reading and handling return requests.
- Finance: settlements, statements and transactions.
- Promotions and affiliates: available in some markets and versions.
Webhooks for Real-Time Updates
Instead of repeatedly polling for changes, apps can subscribe to webhooks, which are notifications sent to your server when events happen, such as a new order, an order status change, a cancellation or a product status change. Your endpoint must respond quickly and verify that notifications are genuine. Treat webhooks as triggers: when one arrives, fetch the latest data through the API, because notifications may be delayed, duplicated or arrive out of order.
Rate Limits
The API limits how many requests an app can make in a given period. Exceeding limits returns errors and can slow your integration. Design for limits: batch requests where the API allows, cache data that does not change often, use webhooks rather than constant polling and retry failed requests with exponential backoff. During peak events, request volumes rise sharply, so test your integration at high load before big campaigns.
Sandbox and Testing
Where a sandbox or test environment is offered, build and test there first. Otherwise, test with a real shop carefully, using test products that are not visible to shoppers where possible. Test the full cycle: create a product, update stock, receive an order, ship it with tracking, process a cancellation and handle a return. Test failure cases too, such as expired tokens, invalid signatures and rate limit errors.
Error Handling and Logging
Log every API request and response status, without logging secrets or personal data unnecessarily. Clear logs make it possible to diagnose sync problems quickly. Alert someone when errors spike, tokens fail to refresh or webhook deliveries stop. A silent integration failure can cause oversells or late shipments within hours.
Data Protection and Security
Order data contains customer names, addresses and phone numbers. Collect only what you need, store it securely, restrict access and delete it according to policy and law. Follow the data use rules in the developer terms, which often limit how customer data can be used, for example banning use for unrelated marketing. Rotate secrets if you suspect exposure, and review which shops have authorised your app. Our guide to account security covers wider practices.
Versioning and Maintenance
APIs evolve. New versions add features and older versions are eventually retired. Subscribe to developer announcements, track deprecation notices and schedule time each quarter to update your integration. An integration built once and never maintained will eventually break.
A Worked Example: Syncing Stock From an ERP
A homeware brand manages stock in a custom ERP. Its developer registers an app, requests product and order scopes, and the brand authorises the app from its seller account. The app maps each ERP item to a TikTok Shop SKU by seller SKU code. When stock changes in the ERP, the app updates TikTok Shop stock through the API. When a new order webhook arrives, the app fetches the order and creates it in the ERP. Tracking numbers flow back when the warehouse ships. Token refresh runs automatically, and errors alert the developer by email. Before the next major sale, the developer load-tests the integration with simulated volumes.
Mapping Data Between Systems
Most integration problems are mapping problems rather than code problems. Every system names things differently: your ERP may call it an item code while TikTok Shop calls it a seller SKU; your warehouse may use location codes that do not match TikTok warehouse IDs; your carrier names may not match the supported carrier list. Before writing code, build a mapping table for SKUs, warehouses, carriers, order statuses and categories, agreed with the operations team. Store mappings in configuration rather than hard-coding them, so they can be updated when products or partners change.
Also decide which system is the source of truth for each type of data. Stock usually comes from the warehouse or ERP, product content may come from a product information system, and order status comes from TikTok Shop. Clear ownership prevents systems from overwriting each other in endless loops.
Common API Pitfalls
- Not refreshing access tokens.
- Incorrect request signatures.
- Ignoring rate limits during peaks.
- Relying on webhooks without fetching current data.
- Missing SKU mappings between systems.
- Storing secrets insecurely.
- No monitoring or alerts.
API Integration Checklist
- Confirm a custom build is needed.
- Register a partner app and request only needed scopes.
- Implement authorisation and automatic token refresh.
- Sign requests exactly as documented.
- Use webhooks plus data fetches.
- Design for rate limits and test at load.
- Log, monitor and maintain the integration.
Desnora helps brands plan TikTok Shop integrations and choose between apps and custom builds. Explore our TikTok Shop services or contact us.
Frequently Asked Questions
What is the TikTok Shop Open API?
A set of interfaces that let approved apps read and update shop data such as products, orders, logistics and finance.
How do I get API access?
Register in the TikTok Shop partner or developer portal, create an app and have the shop authorise it.
Do I need a developer to use the API?
Yes. The API requires programming. Many sellers use ready-made apps instead.
What is an access token?
A credential the app uses to call the API for an authorised shop. It expires and must be refreshed.
Why are my API requests failing with signature errors?
The signature does not match the documented algorithm. Check parameter order, encoding and timestamp.
What are webhooks?
Notifications sent to your server when events occur, such as new orders or status changes.
Are there rate limits?
Yes. Design for limits with batching, caching, webhooks and retries with backoff.
Is there a sandbox?
Check the developer portal for your market. Where none exists, test carefully with a real shop.
Can I use customer data from the API for marketing?
Follow the developer terms and law, which often restrict use of customer data beyond fulfilling orders.
Should I build or buy an integration?
Buy when an existing app meets your needs; build when you have custom systems or requirements.
How often does the API change?
Regularly. Follow developer announcements and schedule maintenance each quarter.
What should I monitor in an integration?
Error rates, token refresh failures, webhook deliveries and sync delays, with alerts when they spike.