Tiktok

TikTok — recon plan (hardest: anti-bot signing)

Internal API: https://www.tiktok.com/api// with a large param set plus anti-bot signing: msToken (cookie + param), X-Bogus / _signature / X-Gnarly — generated by TikTok's obfuscated webmssdk JS. Hand-crafting signed requests from scratch is impractical; use the page's own signer or its own fetches.

The winning move: stay in-page, reuse TikTok's signer

Because we run inside the loaded tiktok.com page, the signing code is already present. Two viable strategies (capture which works):

1. Reuse the page's fetch path — trigger the action via the UI (scroll feed,

open a video, open comments) and read the resulting /api/ JSON responses from list_network_requests / a fetch-hook. Lowest-friction for READS.

1. Call the in-page signer — TikTok exposes signing via globals

(window.byted_acrawler / the SDK's sign fn) used to build X-Bogus. If reachable, sign your own request params in-page, then fetch. Capture the exact global + signature param names live (they change).

Auth: cookies (sessionid, tt_csrf_token, msToken) ride same-origin; writes need sessionid + valid signature.

Endpoints (capture live; param sets are huge + signed)

| Purpose | endpoint | | ------------------------ | --------------------------------------- | | For-You feed | /api/recommend/item_list/ | | A user's videos | /api/post/item_list/?secUid= | | User detail | /api/user/detail/?uniqueId= | | Comments (who/likes) | /api/comment/list/?aweme_id= | | Video detail | /api/item/detail/?itemId= | | Search | /api/search/general/full/?keyword= | | WRITE: like (digg) | /api/commit/item/digg/ | | WRITE: follow | /api/commit/follow/user/ | | WRITE: comment | /api/comment/publish/ |

Entity model

User{id, uniqueId(handle), secUid, nickname, followerCount} · Video{id(aweme_id), desc, author:User, stats:{diggCount, commentCount, shareCount, playCount}} · Comment{user, text, diggCount}.

Capture method

Open tiktok.com → list_network_requests for /api/ → note endpoint + the signed params (X-Bogus, msToken, _signature) + whether the response is readable. Probe for the signer global in-page.

Actions to test (read-first; writes gated + likely blocked)

1. Open a profile/video via UI → read the /api/ responses (feed, user,

comments).

1. If a signer global is reachable → try a signed read (e.g. comment/list).
2. who-commented + diggCount → engagement graph.
3. (gated, expect friction) digg/follow/comment — explicit confirm.

Gotchas — manage expectations

• TikTok has the strongest anti-automation of the set. Signed-request

replication is fragile + drifts; expect blocks/captchas on writes.

• Prefer read via the page's own responses / UI-driving over hand-signed

fetches. Writes: minimal, gated, accept they may fail.

• This is the one platform where DOM / UI-driving may beat the API approach.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: agentproto
• Source: agentproto/ts
• License: Apache-2.0
• Homepage: https://agentproto.sh

Install and usage instructions live in the source repository linked above.