0

I have followed TikTok's docs here and here, step by step to setup user login through TikTok, but it sounds the docs are not clear enough, AppDelegate and Info.plist are correctly setup and there is no SceneDelegate in my test project, I'm using the following function to kick-off the login:

func startTikTokLogin() {
        
        /* STEP 1 */
        let scopes = ["user.info.basic"] // list your scopes
        let scopesSet = NSOrderedSet(array: scopes)
        let request = TikTokOpenSDKAuthRequest()
        
        
        request.permissions = scopesSet
        
        /* STEP 2 */
        request.send(self, completion: { resp -> Void in
            /* STEP 3 */
            if resp.isSucceed {
                print("TikTok success case")
                /* STEP 3.a */
                let clientKey = "my_client_key"
                let responseCode = resp.code!
                
                let baseURlString = "https://open-api.tiktok.com/demoapp/callback/?code=\(responseCode)&client_key=\(clientKey)"
                let url = NSURL(string: baseURlString)
                
                /* STEP 3.b */
                let session = URLSession(configuration: .default)
                let urlRequest = NSMutableURLRequest(url: url! as URL)
                let task = session.dataTask(with: urlRequest as URLRequest) { (data, response, error) -> Void in
                    /* STEP 3.c */
                    let str = try! JSONSerialization.jsonObject(with: data!)
                    print("returned access token")
                    print(str)
                    
                }
                task.resume()
            } else {
                // handle error
                print("TikTok error case  \(resp.errString!) - \(resp.errCode.rawValue)")
            }
        })
    }

However, if the app is installed on device it opens displaying the following error message: Illegal authorization scope.

If the app is not installed an auth view controller (SafariViewController) opens and when I finish entering user credentials the SafariViewController dismisses and the else case above is executed printing the following error string and code in the console: param_error - 10006.

I searched on TikTok's developer website for that error, it says:

10006 : Illegal redirection URI needs to be consistent with the "authorized callback domain" in the app configuration.

The error is misleading because there is nothing called callback domain in the app configuration section as the only enabled platform is iOS (no Web and no Android).

in Info.plist I've set the client key in the TikTokAppID and CFBundleURLSchemes keys as stated in the docs and I even tried to set the app ID in those two keys but to no avail.

I tried to follow the answer here but that didn't solve my problem.

Here's a small demo if what's going on (right: iPhone 12 Pro device with TikTok app installed, left: iPhone SE 3rd generation simulator):

enter image description here

P.S. the app is currently under review but I got a client id and secret once I first created the app (no review is required to get these two values).

JAHelia
  • 6,934
  • 17
  • 74
  • 134

1 Answers1

1

There are 2 ways, Tiktok can communicate with your app

  1. If TikTok app is installed and you registered TikTokAppID in your app's plist file then when TikTok Auth is completed, it will call back to your app.
  2. If TikTok app is not installed, then when you call TikTok auth, your app will open a browser (outside of your app), after getting the token from the browser, the browser will need a middleman to call back to your app. This is where you need to introduce an endpoint to wake your app up.

The format of your endpoint should be <your_domain>/app_name/callback/?code=\(responseCode)&client_key=\(clientKey)

So in your code, you're calling the above format with the TikTok domain. Did you have any endpoints under this domain https://open-api.tiktok.com/ and the route is demoapp/callback? If not then that's the reason why you got errors

Tran To
  • 285
  • 1
  • 6
  • Regarding point (2): TikTok recommends to have a wrapper API like the one you mentioned to hide the `client_secret` string in the server, but it's not mandatory to have this wrapper API as stated in their docs: `... Security Advisory: If you notice, one of the query parameters in this URL is the client_secret. It is NOT safe to have this client secret on your application or to make this request from your app. We highly recommend keeping the client secret on the server, creating a wrapper API to send the code and client key to your server, and from your server, make this request.` – JAHelia Sep 04 '22 at 06:36
  • That means you will keep the client key on your server, and create a wrapper endpoint to handle the call back. So it’s mandatory – Tran To Sep 04 '22 at 07:08
  • There is no way to set my endpoint address ( which acts as a middle man to redirect to my app) in the app settings page in TikTok, plus the completion block above enter the `else` case which's failure case, i.e. there is no response code is returned – JAHelia Sep 10 '22 at 13:26
  • Did you solve the issue @TranTo? We are facing the same error and doubts. – Alberto Dallaporta Mar 24 '23 at 09:37