Configurable TikTok OAuth scopes for apps without the Display API

.env.example

@@ -134,6 +134,8 @@ X_CLIENT_REDIRECT="${APP_URL}/accounts/x/callback"
 TIKTOK_CLIENT_ID=
 TIKTOK_CLIENT_SECRET=
 TIKTOK_CLIENT_REDIRECT="${APP_URL}/accounts/tiktok/callback"
+# Trim when the TikTok app lacks Display API (no longer offered to new apps):
+# TIKTOK_SCOPES="user.info.basic,video.publish,video.upload"
 
 # Facebook (https://developers.facebook.com)
 FACEBOOK_CLIENT_ID=

app/Http/Controllers/Auth/TikTokController.php

@@ -20,14 +20,16 @@ class TikTokController extends SocialController
 
     protected SocialPlatform $platform = SocialPlatform::TikTok;
 
-    protected array $scopes = [
-        'user.info.basic',
-        'user.info.profile',
-        'user.info.stats',
-        'video.publish',
-        'video.upload',
-        'video.list',
-    ];
+    /**
+     * Requested scopes come from config so self-hosters whose TikTok app lacks
+     * a product (Display API is no longer offered to new apps, taking
+     * user.info.profile/stats and video.list with it) can trim the list via
+     * TIKTOK_SCOPES instead of hitting a "scope" error on the consent screen.
+     */
+    private function scopes(): array
+    {
+        return (array) config('trypost.platforms.tiktok.scopes');
+    }
 
     public function connect(Request $request): Response
     {
@@ -37,7 +39,7 @@ public function connect(Request $request): Response
 
         $this->authorize('manageAccounts', $workspace);
 
-        return $this->redirectToProvider($request, $this->driver, $this->scopes, [
+        return $this->redirectToProvider($request, $this->driver, $this->scopes(), [
             'disable_auto_auth' => 1,
         ]);
     }
@@ -48,7 +50,7 @@ public function callback(Request $request): InertiaResponse
 
         try {
             $socialUser = Socialite::driver($this->driver)
-                ->scopes($this->scopes)
+                ->scopes($this->scopes())
                 ->user();
 
             // TikTok returns username via getNickname() when user.info.profile scope is included

app/Models/SocialAccount.php

@@ -289,9 +289,10 @@ protected function profileUrl(): Attribute
     /**
      * "@handle" for notification bodies — the more specific identifier
      * (username) wins over the friendlier display name when both are set.
-     * Every connector requests enough scope to always populate at least one
-     * of username/display_name (e.g. TikTok always requests user.info.profile);
-     * the platform label is a last-resort fallback, not an expected path.
+     * Connectors normally populate at least one of username/display_name
+     * (TikTok Login Kit still returns display_name via user.info.basic;
+     * username needs user.info.profile, which self-hosters may trim).
+     * The platform label is a last-resort fallback, not an expected path.
      */
     public function handle(): string
     {

config/trypost.php

@@ -191,6 +191,10 @@
         'tiktok' => [
             'enabled' => env('TIKTOK_ENABLED', true),
             'api' => env('TIKTOK_API', 'https://open.tiktokapis.com/v2'),
+            // OAuth scopes to request. Trim when the TikTok app lacks a product
+            // (e.g. no Display API => drop user.info.profile, user.info.stats,
+            // video.list; analytics degrade gracefully, username stays empty).
+            'scopes' => array_values(array_filter(array_map('trim', explode(',', (string) env('TIKTOK_SCOPES', 'user.info.basic,user.info.profile,user.info.stats,video.publish,video.upload,video.list'))))),
         ],
         'youtube' => [
             'enabled' => env('YOUTUBE_ENABLED', true),

docker/.env.docker.example

@@ -106,6 +106,7 @@ X_CLIENT_REDIRECT="${APP_URL}/accounts/x/callback"
 TIKTOK_CLIENT_ID=
 TIKTOK_CLIENT_SECRET=
 TIKTOK_CLIENT_REDIRECT="${APP_URL}/accounts/tiktok/callback"
+# TIKTOK_SCOPES="user.info.basic,video.publish,video.upload"
 
 FACEBOOK_CLIENT_ID=
 FACEBOOK_CLIENT_SECRET=

tests/Feature/Social/TikTokControllerTest.php

@@ -27,6 +27,59 @@
         ->toContain('disable_auto_auth=1');
 });
 
+test('tiktok authorize url carries the default scopes', function () {
+    $response = $this->actingAs($this->user)->get(route('app.social.tiktok.connect'));
+
+    expect(urldecode((string) $response->headers->get('Location')))
+        ->toStartWith('https://www.tiktok.com/v2/auth/authorize')
+        ->toContain('user.info.basic')
+        ->toContain('user.info.profile')
+        ->toContain('user.info.stats')
+        ->toContain('video.publish')
+        ->toContain('video.upload')
+        ->toContain('video.list');
+});
+
+/**
+ * Mock the TikTok driver, hit connect, and return the scopes the controller asked for.
+ *
+ * @return array<int, string>
+ */
+function captureTikTokConnectScopes(object $test): array
+{
+    $captured = [];
+
+    $driverMock = Mockery::mock();
+    $driverMock->shouldReceive('scopes')
+        ->withArgs(function (array $scopes) use (&$captured) {
+            $captured = $scopes;
+
+            return true;
+        })
+        ->andReturnSelf();
+    $driverMock->shouldReceive('with')->with(['disable_auto_auth' => 1])->andReturnSelf();
+    $driverMock->shouldReceive('redirect')->andReturn(Mockery::mock([
+        'getTargetUrl' => 'https://www.tiktok.com/v2/auth/authorize?test=1',
+    ]));
+
+    Socialite::shouldReceive('driver')->with('tiktok')->andReturn($driverMock);
+
+    $test->actingAs($test->user)
+        ->get(route('app.social.tiktok.connect'));
+
+    return $captured;
+}
+
+test('tiktok connect requests scopes from config', function () {
+    config(['trypost.platforms.tiktok.scopes' => ['user.info.basic', 'video.publish', 'video.upload']]);
+
+    expect(captureTikTokConnectScopes($this))->toEqual([
+        'user.info.basic',
+        'video.publish',
+        'video.upload',
+    ]);
+});
+
 test('tiktok connect redirects to oauth provider', function () {
     $driverMock = Mockery::mock();
     $driverMock->shouldReceive('scopes')->andReturnSelf();