来自 TikTok Shop 官方资料快照 ·
- 当前资料结构化阅读页
- 固定快照已留存，可追溯
- 官方原文可核对
资料正文
§1 Gateway HTTP Access to Be Discontinued
Breaking change. From [2026-06-17], the TikTok Shop Open Platform gateway open-api.tiktokglobalshop.com will accept HTTPS only. Requests sent over plain http:// will be rejected and will not be processed. Make sure every integration calls the gateway over https:// before this date to avoid service disruption.
§2 Summary
To strengthen the security of data in transit, access to the API gateway open-api.tiktokglobalshop.com will move to HTTPS-only. Plain-text HTTP access will be deprecated and then permanently discontinued. This change affects the transport protocol only — API endpoints, request/response formats, authentication, and request signing are unchanged.
| Field | Detail |
|---|---|
| Change type | Breaking change |
| Affected gateway | open-api.tiktokglobalshop.com |
| Affected APIs | All APIs and all versions served on this gateway |
| What changes | HTTP (plain-text) access removed; HTTPS required |
| Action required | Yes — migrate all requests to https:// |
| Enforcement date (HTTP off) | [Enforcement date — 2026-06-17] |
§3 What is changing
Today the gateway is reachable over both HTTP and HTTPS. After the enforcement date, only HTTPS will be accepted.
❌ Before — removed
http://open-api.tiktokglobalshop.com/...
Plain-text, unencrypted. Rejected after enforcement.
✅ After — required
https://open-api.tiktokglobalshop.com/...
Encrypted over TLS. Continues to work.
Do not rely on an automatic HTTP-to-HTTPS redirect; design your integration to call the HTTPS endpoint directly.
§4 Why this change
Reason: Plain HTTP transmits data in clear text, exposing it to interception and tampering. HTTPS (TLS) encrypts traffic end to end.
- Protects API credentials (app key, access token) and request signatures from being intercepted.
- Protects sensitive commerce data (orders, buyers, fulfilment) while in transit.
- Mitigates man-in-the-middle and eavesdropping attacks.
- Aligns the gateway with platform security and compliance standards and API security best practice.
§5 Who is affected
- Affected: any app or integration that calls
open-api.tiktokglobalshop.comoverhttp://— including hard-coded URLs, outdated SDK versions, and proxies that downgrade to HTTP. - Not affected: integrations that already use
https://for every request — no action needed.
§6 What you need to do
Complete the following before the enforcement date:
- [ ] Audit your integration for any use of http://open-api.tiktokglobalshop.com — in code, config files, environment variables, and SDK settings.
- [ ] Update all gateway base URLs and endpoints to https://open-api.tiktokglobalshop.com.
- [ ] Upgrade to the latest official SDK if you use one (recent versions default to HTTPS).
- [ ] Ensure your HTTP client, proxies, and network egress allow outbound TLS (port 443) to the gateway.
- [ ] Re-test critical flows over HTTPS: authorization / token, products, orders, fulfilment, and any callbacks.
- [ ] Confirm no HTTP traffic remains during the brownout windows.
- http://open-api.tiktokglobalshop.com/...
+ https://open-api.tiktokglobalshop.com/...
§7 How to verify
- Confirm every request URL begins with
https://. - Check logs and metrics for any outbound requests to port 80 or
http://on the gateway domain — there should be none. - During the brownout windows, confirm your integration keeps working (i.e. it is already on HTTPS).
§8 FAQ
| Question | Answer |
|---|---|
| Will there be an automatic HTTP-to-HTTPS redirect? | Do not rely on it. Plan for HTTP to be rejected and call the HTTPS endpoint directly. |
| Do I need to change my signature or authentication? | No. Only the URL scheme changes; signing and authentication are unchanged. |
| I already use HTTPS everywhere — is there anything to do? | No action required. |
| What happens if I still send HTTP after the enforcement date? | The request is rejected and not processed, which can cause failed API calls and service disruption. |