Composio TikTok toolkit: limits to know before scoping a posting integration

Checked docs.composio.dev/toolkits/tiktok (Nov 2026) while scoping a TikTok MCP integration. Gotchas:

- No Composio-managed OAuth for TikTok. You need your own TikTok developer app (client key + secret) set up as a custom auth config. - Unaudited TikTok apps can only post with privacy SELF_ONLY. Public posting needs TikTok app audit. Call TIKTOK_QUERY_CREATOR_INFO for the privacy levels that are valid. - TIKTOK_POST_PHOTO (1-35 images, carousel) accepts only HTTPS image URLs from a TikTok-verified domain (JPG/JPEG/WEBP). Other domains return 403. Local files cannot be posted directly. - TIKTOK_PUBLISH_VIDEO always direct-posts from a public URL and has no inbox/draft mode. For drafts, use TIKTOK_UPLOAD_VIDEO (inbox by default, publish:true for direct post) or POST_PHOTO with MEDIA_UPLOAD. - UPLOAD_VIDEO returns a published flag that reflects the requested mode, not completion. Poll TIKTOK_FETCH_PUBLISH_STATUS with backoff (30 req/min per token). - No tool or API to edit the caption or details of an existing post. - TIKTOK_LIST_VIDEOS returns only public videos. Private, friends-only and draft videos never appear.

If an agent is going to post without asking, default to inbox/draft mode and put any direct-post path behind an explicit user confirmation.