What this API does and who it is for
TikTok's mobile clients rely on a layered security architecture — several proprietary headers authenticate and protect every outbound request. Reproducing those headers without access to TikTok's own SDK requires implementing (or delegating) several algorithms: MSSDK, TTEncrypt, Argus, Ladon, Gorgon, Khronos, and Cylons. ByteDance Services offloads that complexity to a hosted API, accepting raw or hexadecimal-encoded payloads and returning the corresponding encrypted or signed output.
The primary audience is developers building tools that interact with TikTok at the HTTP level — data pipelines, automation scripts, or research tooling — where generating correct security headers programmatically is a prerequisite. Because the underlying algorithms change with each TikTok release, keeping an in-house implementation current is non-trivial; the API's value proposition is largely that it tracks those changes. The latest supported MSSDK version at the time of this writing is v05.02.00-alpha.5-ov-android.
Endpoint walkthrough
The API exposes 12 endpoints split into three logical groups.
Signature generation
POST /mssdk_common/sign is the central endpoint for most integrations. It generates all four signature headers — X-Argus, X-Ladon, X-Gorgon, and X-Khronos — in a single call. The required parameters differ depending on whether the request is for an authenticated (logged-in) or unauthenticated session, so reading the provided examples before integrating is essential.
POST /cylons/encrypt generates the X-Cylons header used with WebSocket connections on any MSSDK platform. Two distinct scenarios are documented: the initial handshake and ongoing communication frames. Each has a different input shape, so treat them as separate flows.
Encryption and decryption
MSSDK — POST /mssdk_common/encrypt and /mssdk_common/decrypt work with hexadecimal-encoded buffers. The key parameter accepts integer values 0 through 4, selecting the encryption key variant. The encrypted output is intended to be embedded in a protobuf payload; the decrypt endpoint expects raw MSSDK-encrypted data (no-delimiter hex) rather than a fully wrapped protobuf.
TTEncrypt — POST /ttcrypt/encrypt and /ttcrypt/decrypt handle TikTok's TTEncrypt scheme. Both endpoints expose a compress flag. For device_register requests specifically, that flag must be set to true on encryption and decompress must be true on decryption to recover the original JSON body.
Ladon — POST /ladon/encrypt and /ladon/decrypt handle the X-Ladon header value. A matching POST /argus/decrypt endpoint decrypts X-Argus headers, which is useful for inspecting existing traffic.
Report encoding
Three endpoints cover TikTok's ri/report protobuf: POST /risk_report/string/encode, /risk_report/string/decode, and /risk_report/generate_field220. The last one generates field 66 (the debug check field); the documentation notes all flags should be set to 0 to signal successful debug checks.
Pricing
The API follows a freemium model with four plans.
| Plan | Monthly price | Included requests | Rate limit | Overage per request |
|---|---|---|---|---|
| BASIC | $0 | 20 per day | — | — |
| PRO | $25 | 100,000 per month | 5 req/s | $0.0200 |
| ULTRA (recommended) | $50 | 600,000 per month | 10 req/s | $0.0001 |
| MEGA | $100 | 2,000,000 per month | 25 req/s | — |
A few things stand out here. The BASIC tier's 20-request daily cap is genuinely narrow — enough to verify that your integration works, but far too low for any production use. Once you cross that threshold you need at least PRO.
The overage pricing on PRO ($0.0200 per request) is steep: going 10,000 requests over the monthly allowance adds $200 to a $25 base bill. By contrast, ULTRA's overage rate is $0.0001 per request — two orders of magnitude cheaper — which likely explains why it carries the recommended label. If your usage fluctuates month to month, ULTRA is the safer choice even if your baseline would fit within PRO's 100,000-request allocation. MEGA provides no overage pricing in the published plan, implying it is intended for high-volume consumers who stay within the 2,000,000-request ceiling.
Private or custom plans can be negotiated by contacting the provider directly via Telegram (@leilameital), Matrix (@leilameital:matrix.org), or email ([email protected]).
Practical use cases
- TikTok data collection — Fetching user timelines, search results, or video metadata over TikTok's private API requires valid signature headers on every request. ByteDance Services removes the need to maintain that signing logic locally.
- Device registration automation — The TTEncrypt endpoint explicitly documents behavior for
device_registerflows, covering one of the more complex request types in TikTok's onboarding sequence. - Traffic inspection and research — The decrypt endpoints for X-Argus and X-Ladon let you decode headers captured from live TikTok traffic, which is useful when mapping the API surface or debugging integration issues.
- WebSocket-based features — X-Cylons generation for both handshake and communication phases supports integrations that interact with TikTok's real-time infrastructure.
Limitations and things to check before integrating
MSSDK versioning — TikTok updates its SDK regularly. The API tracks the latest release, but version mismatches between what the API generates and what TikTok's servers currently accept can cause silent failures. Confirm the supported version aligns with the TikTok client version your integration targets before committing to a plan.
Protobuf assembly is your responsibility — The MSSDK encrypt endpoint returns a payload that must be placed inside a request protobuf. The API does not construct the full protobuf for you. You need to understand TikTok's protobuf schema to use the output correctly.
Rate limits on lower tiers — The BASIC plan exposes no documented rate limit, which is consistent with its low daily cap. PRO is capped at 5 requests per second; for concurrent workflows, that ceiling can become a bottleneck quickly.
Single provider dependency — Because this is a specialist third-party service rather than an official TikTok product, any changes to TikTok's security architecture may introduce a lag before the API catches up. The 100% reported success rate is a strong signal of current reliability, but is worth monitoring over time.
Getting started
The free BASIC plan requires no upfront payment, making it the right starting point. Use the 20 daily requests to validate your integration against each endpoint category you plan to use — at minimum, run the signature generation endpoint with both an authenticated and unauthenticated payload shape to confirm your request construction is correct. Pay particular attention to the TTEncrypt compress flag and the MSSDK key variants, since incorrect values will produce outputs that TikTok's servers reject without a meaningful error.
Once you have a working proof of concept, project your monthly request volume realistically against the PRO and ULTRA tier allocations before choosing a paid plan, and factor in the overage pricing difference if your usage is unpredictable.
