Authentication
All requests use your FetchLayer API key as a Bearer token. There is no TikTok account, no OAuth flow and no developer application to apply for — this reads what an unauthenticated visitor to tiktok.com can see.
Sending requests
bash
curl -X POST https://api.fetchlayer.dev/tiktok/user-profile \
-H "Authorization: Bearer ss-your-key" \
-H "Content-Type: application/json" \
-d '{"username":"@nasa"}'Keep your key secret
Only use API keys in server-side code and rotate a key immediately if it is exposed.
POST for data, GET for media
Every data route takes a JSON body over POST, so nothing sensitive travels in a URL. The one exception is GET /tiktok/media, which streams image bytes and takes the asset URL as a query parameter; it carries the same Bearer header. Unrecognised body fields are rejected with a 400 naming the field, so a typo such as usernam fails loudly instead of being quietly ignored.
Authentication errors
A missing or invalid key returns HTTP 401. A key scoped to other platforms returns HTTP 403.
json
{
"error": "Invalid API key"
}