How AdLoomly integrates with TikTok
A complete, technical description of our TikTok Marketing API integration — how authorization works, exactly which scopes we request, what data flows where, and how to revoke access.
Overview
AdLoomly connects to TikTok exclusively through the official TikTok Marketing API over HTTPS. There is no scraping, no browser automation, and no other access path. Every feature in the product — the Campaign Launcher, Automation Rules, and Ad Spend Analytics — is built on documented Marketing API endpoints, and every request is authorized by an access token that you granted via TikTok's OAuth 2.0 advertiser authorization flow.
Authorization flow
Connecting an ad account uses TikTok's standard OAuth 2.0 flow through TikTok Business Center. Your TikTok password is entered only on TikTok's own pages — AdLoomly never sees or stores it.
- You click Connect TikTok in the AdLoomly dashboard.
- You are redirected to TikTok's authorization page.
- You review the requested permissions on TikTok's page and approve (or decline).
- TikTok redirects back to AdLoomly with a short-lived authorization code.
- AdLoomly exchanges the code server-side for an access token. The exchange never happens in the browser, and the token is never exposed to it.
- The token is stored encrypted (AES-256 at rest), and you return to the dashboard with your ad account connected.
Scopes we request
We follow a least-privilege policy: every scope below maps directly to a product feature, and we request nothing beyond this list.
| Scope | What it enables | Used by |
|---|---|---|
| Ad Account Information (read) | List your authorized ad accounts | Account picker |
| Campaigns / Ad Groups / Ads (read) | Show structure & status | Dashboard, rules |
| Campaigns / Ad Groups / Ads (create & update) | Bulk launching, pause/activate, budget & bid changes | Launcher, rule actions |
| Reporting — Consolidated Report (read) | Spend & performance metrics | Analytics, rule conditions |
| Automated Rules (read, create & update) | Manage rules that run server-side | Rule engine |
Data flow & storage
What we fetch
- Campaign, ad group, and ad metadata: IDs, names, status, budgets, and bids.
- Performance metrics — spend, impressions, clicks, conversions, CPA, CPM, and ROAS — via the consolidated reporting endpoint
/report/integrated/get/.
We do not fetch end-user or viewer personal data, audience list contents, or your ad account's payment details. See the full "never collected" list on our Security page.
Sync cadence
Metrics sync on an interval determined by your plan — hourly on Free, every 15 minutes on Starter, every 5 minutes on Pro. Structural changes made through AdLoomly (launches, pauses, budget updates) are written to TikTok immediately and reflected in the dashboard as soon as the API confirms them.
Where it lives, and for how long
- All TikTok-derived data is stored in an encrypted database (AES-256 at rest, TLS 1.2+ in transit).
- Performance metrics are retained on a rolling 24-month window so you can see long-term trends.
- On disconnect, the access token is revoked immediately and all TikTok-derived data is deleted within 30 days.
Rate limits & good citizenship
We respect TikTok Marketing API rate limits by design. Requests are batched wherever the API allows (for example, launching up to 50 ad groups per batch and requesting reports for multiple entities in a single call), sync jobs are spread over time rather than bursting, and when the API returns a 429 response we back off exponentially and retry later instead of hammering the endpoint. Rule evaluation runs against our synced metrics store, not against live API calls, which keeps our request volume low and predictable.
Revocation
Access can be revoked from either side, with immediate effect:
- From AdLoomly: click Disconnect on the ad account in your dashboard settings.
- From TikTok: remove AdLoomly's authorization in TikTok Business Center.
Either path stops all API calls immediately. The stored token becomes unusable, active rules stop executing against the account, and the 30-day deletion window for TikTok-derived data begins.
Compliance
Our integration adheres to the TikTok Marketing API Terms, the TikTok Business Products (Data) Terms, and TikTok Advertising Policies. AdLoomly is built on the official TikTok Marketing API; we do not claim any partner or certification status. For how we handle personal data more broadly, see our Privacy Policy and Security pages, or write to developers@adloomly.com with technical questions about this integration.