SSO
TikTok
Add TikTok sign-in to VitNode with Login Kit for Web. Create a TikTok app, register the HTTPS redirect URI, test in sandbox and confirm new members' email.
Add a Continue with TikTok button using TikTok's Login Kit for Web. The adapter asks only for user.info.basic. TikTok never shares an email address, so new members confirm one by email.
Before you begin
- A running VitNode app. This page covers only the TikTok parts; SSO setup explains the shared steps and where the API's
.envand config live. - A TikTok for Developers account.
- A public HTTPS redirect URI. TikTok requires an absolute
https://redirect URI for web apps, with no query string or fragment, so develop through a tunnel (see Develop locally). - An email adapter, to send the confirmation link.
Set up the app
Create an app
In the TikTok developer portal, press Connect an app, choose an organization or individual owner, and fill in the app name, icon, category, description, terms of service and privacy policy URLs.
Add Login Kit and the redirect URI
Under Products, add Login Kit. In its settings, choose Web and add the redirect URI:
| Environment | Redirect URI |
|---|---|
| Production | https://your-domain.com/login/sso/tiktok |
| Development | https://forum-dev.example.com/login/sso/tiktok |
TikTok needs an absolute, static HTTPS URL with no query string. VitNode builds it as {VITNODE_WEB_URL}/login/sso/tiktok, so they must match exactly.
Check the scope
Under Scopes, make sure user.info.basic is listed. It is all VitNode needs; leave out user.info.profile, video.list and the rest.
Copy the credentials
Copy the Client Key and Client Secret from the app's credentials into server-side variables:
TIKTOK_CLIENT_KEY=awxxxxxxxxxxxxxx
TIKTOK_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxAdd the adapter
Add TikTokSSOApiPlugin to authorization.ssoAdapters in the API's vitnode.api.config.ts (where it lives), next to any adapters you already have. Keep the rest of the config as it is:
import { TikTokSSOApiPlugin } from '@vitnode/core/api/adapters/sso/tiktok'
import { buildApiConfig } from '@vitnode/core/vitnode.config'
export const vitNodeApiConfig = buildApiConfig({
// ...
authorization: {
ssoAdapters: [
// ...
TikTokSSOApiPlugin({
clientKey: process.env.TIKTOK_CLIENT_KEY,
clientSecret: process.env.TIKTOK_CLIENT_SECRET,
}),
],
},
})No authorization block yet? Create one with just ssoAdapters, as in the SSO setup. Then restart the dev server, since .env and the API config are only read at start-up.
Check the result
Open /login on your HTTPS domain, press the TikTok button under Continue with and authorize. The first time, VitNode asks for an email and sends a confirmation link. Open it in the same browser. After that, the same TikTok account signs straight in.
Test in sandbox, then submit for review
A new app cannot be used by the public until TikTok approves it. To test before that, create a Sandbox for the app in the developer portal and add up to ten target users. Only those TikTok accounts can sign in. Use the credentials shown for the sandbox while you test.
When it works, switch the variables to the production credentials and Submit for review. TikTok asks you to explain each product and scope and to upload at least one demo video. For apps created after 9 September 2024, the terms of service, privacy policy and website URLs must first be verified as URL properties in the portal.
Develop locally
Run the dev server behind an HTTPS tunnel (for example Cloudflare Tunnel or ngrok), add that URL to Login Kit, and set:
VITNODE_WEB_URL=https://forum-dev.example.com
VITNODE_API_URL=https://forum-dev.example.comScopes and profile fields
| Setting | Value |
|---|---|
| Scopes | user.info.basic |
| Account ID | open_id (unique to your app) |
| never shared; confirmed by email | |
| Profile fields | avatar |
The display name becomes the new account's name. Import the avatar from Connected accounts; VitNode downloads and stores its own copy.
Troubleshooting
- "redirect_uri" error on TikTok's page. The URI in Login Kit differs from
{VITNODE_WEB_URL}/login/sso/tiktok, or it is not HTTPS. - "client_key" error. You used the sandbox key with production credentials, or the other way round.
- Only some accounts can sign in. The app is still in sandbox; add them as target users or submit the app for review.