TikTok OAuth
TikTok credentials are entered only on TikTok's authorization pages. CML Studio does not receive or store the user's TikTok password.
Security
Safeguards for connected accounts and creator content.
CML Studio limits access to sensitive credentials, protects uploaded media from public access, and keeps publishing decisions inside an authenticated workspace.
Encrypted tokens
OAuth access and refresh tokens are encrypted at rest with authenticated encryption and decrypted only on the server for authorized API operations.
Protected media
Uploaded videos are kept outside the public website directory. Preview requests require an active CML Studio session.
Secure sessions
CML Studio uses HTTP-only, secure, same-site session cookies and applies same-origin checks to state-changing browser requests.
Minimal permissions
The current integration requests only the account-information and Direct Post permissions required by the working user flow.
Safe operational logs
TikTok API failures record the endpoint, HTTP status, error code, message, and log ID without recording tokens, secrets, or Authorization headers.
Data flow
Authorization stays between the user, CML Studio, and TikTok.
CML Studio does not sell credentials or expose OAuth tokens to the browser.
- 1User authorizes on TikTok
TikTok returns an authorization code to the registered HTTPS callback.
- 2CML Studio exchanges it server-side
The client secret and token exchange remain on the server.
- 3Tokens are encrypted at rest
They are used only for the connected user's requested API actions.
- 4The user can disconnect
Disconnect removes the local authorization record and prevents future API use.
Report a concern
Responsible security reports are welcome.
If you believe you have found a security or privacy issue, email a clear description to support@pigcml.top. Do not include active passwords, access tokens, or client secrets.