Security and authorization
Authorization is a provider decision, not a browser setting.
KALAMI is an internal operations workspace developed and used by 文昌市鑫博帆商贸有限公司. The TikTok account owner gives consent on TikTok, the server retains only the authorization record needed for the requested feature, and provider responses remain the source of truth for account and publishing status.
Company relationship
文昌市鑫博帆商贸有限公司 owns and operates the KALAMI workspace at https://www.kalamitk.work for its authorized employees, managers, and owner. This page describes the product relationship and security boundary; company registration and domain-ownership evidence must be supplied through the official TikTok review form when requested.
- 01
Official OAuth only
Authorization begins with TikTok Login Kit and returns to a configured HTTPS callback. KALAMI does not use a TikTok password as an integration method.
- 02
Server-side protected authorization data
OAuth access and refresh values returned by TikTok are encrypted for server-side use. They are not exposed as browser-visible account data.
- 03
Declared requested scopes
The production flow requests only the account, video-list, Direct Post, and Inbox draft-upload scopes that support the features described on this website. Inbox upload creates a draft for the creator; it does not claim that TikTok has published the video.
- 04
Explicit publishing checks
A publishing task must select an active locally authorized account. KALAMI verifies the stored grant and requires TikTok's publishing scope before it can create a Direct Post request.
- 05
Removal and failure states
Removing an account deletes the local authorization record. When TikTok rejects, limits, or cannot process an action, KALAMI keeps the action in an explicit provider state instead of reporting false success.