TikTok social login
Allow users to authenticate through TikTok in a Better Auth application.
Better Auth · Const
tiktok
Better Auth's tiktok provider enables TikTok OAuth sign-in. Configure it with TikTok's client key and secret, then call signIn.social({ provider: "tiktok" }).
How it works
The tiktok provider is registered under socialProviders with TikTok's client key and secret. The client starts OAuth sign-in through signIn.social and identifies the provider with provider: "tiktok".
Syntax
socialProviders: { tiktok: { clientKey: string, clientSecret: string } }Parameters
| Name | Type | Description |
|---|---|---|
provider | string | The social provider identifier; for TikTok, set it to tiktok. |
clientKey | string | TikTok client key configured under the provider. |
clientSecret | string | TikTok client secret configured under the provider. |
Returns
The page does not specify a return value for the TikTok provider configuration or social sign-in call.
Key points
- Add TikTok under the authentication instance's
socialProvidersconfiguration. - Read the TikTok client secret from an environment variable rather than hard-coding it.
- TikTok's provider configuration uses a client key alongside the client secret.
- Start the browser sign-in flow through the Better Auth client's social sign-in method.
- Use the literal provider identifier
tiktokwhen invoking social sign-in.
Common mistakes
- Localhost cannot be used for TikTok OAuth; use a public HTTPS domain, such as one provided by a tunneling service.
- Changing Better Auth's authentication route base path requires updating TikTok's configured redirect URL.
- TikTok does not return email addresses, so applications should account for the provider's email limitation.
Example: Configure TikTok social sign-in
import { betterAuth } from "better-auth";
import { createAuthClient } from "better-auth/client";
export const auth = betterAuth({
socialProviders: {
tiktok: {
clientKey: process.env.TIKTOK_CLIENT_KEY!,
clientSecret: process.env.TIKTOK_CLIENT_SECRET!,
},
},
});
const authClient = createAuthClient();
await authClient.signIn.social({ provider: "tiktok" });Configure TikTok with its client key and secret, then start sign-in by passing the TikTok provider identifier.
When to use it
Sandbox testing
Validate OAuth callbacks during development without a production deployment.
HTTPS tunnel development
Run local development against TikTok despite its localhost restriction.
Interview questions
QHow do you configure TikTok in Better Auth?
Register the provider as tiktok inside socialProviders, supplying clientKey and clientSecret. TikTok uses clientKey rather than the more typical OAuth clientId.
Follow-up: What must be configured for local OAuth testing? Use a publicly reachable HTTPS redirect domain because TikTok does not support localhost.
QHow does a client initiate TikTok sign-in?
Call the client’s signIn.social method with an object whose provider value is tiktok. Better Auth then uses the configured TikTok provider for the sign-in flow.
Follow-up: How would you troubleshoot a callback failure after changing routes? Check that TikTok's redirect URL matches the new authentication route base path.
QWhat setup is required before using the provider?
Create an application in TikTok's Developer Portal, enable a sandbox for testing, configure an HTTPS redirect URL, and obtain the client secret and client key. Production use may require approval for requested scopes.
Follow-up: What identity-data limitation affects account handling? TikTok does not provide email addresses, so the integration cannot rely on a provider-supplied email.
Related
betterAuthsocialProviderssignIn.socialcreateAuthClientclientKeyclientSecret