Authorization first.
CustomsJoy is structured around client authorization, approved scopes, separate redirect contexts and server-side credential handling.
Separate authorization contexts
Advertiser authorization and TikTok account-holder authorization use separate redirect URLs and are treated as separate authorization contexts.
Credential handling
Production authorization codes, access tokens, refresh tokens and client secrets are intended to be processed and protected server-side. They are not embedded in public browser JavaScript or reviewer demo records.
Permission boundaries
The service is intended to enable only functions corresponding to the access approved by TikTok and granted by the relevant account or business-asset owner.
Revocation and deletion
Revoked authorizations should not be used for new protected operations. Eligible deletion requests may be submitted through the Data Deletion page or by email to [email protected].