Postman

Postman is a popular API platform for building and testing APIs. You can use Postman to accelerate TikTok Shop API testing and integration. For a first API request, follow the tutorial Call Get Authorized Shops. The endpoint used in this tutorial is documented in the API reference Get Authorized Shops. Use the tutorial page for the end-to-end walkthrough, and use the API reference page for the full endpoint schema.

We provide a ZIP file that contains a Postman collection and a set of environment variables. Fill in the environment variables, including app_key, app_secret, and auth_code, then call GET Access Token to obtain an API access token. The collection can then use the saved variables to call subsequent APIs. Download the Postman collection The original CDN path contains [[, which must be URL-encoded as %5B%5B. The encoded link above is the working download URL. Important: Do not commit, submit, or share any Postman collection, environment file, or script that contains a real App Secret. Use YOUR_APP_SECRET only as a placeholder in examples, and store the real app_secret only in a private Postman environment variable.

This guide uses more than one TikTok Shop domain because each domain has a different purpose.

For authorization entry URLs and market-specific authorization domains, refer to the Authorization guide.

This section walks through obtaining an access_token in Postman. For more information about access tokens, refresh tokens, and required parameters, refer to the Authorization guide. 1. Open a new request tab. Set the request method to GET and use this request URL:

https://auth.tiktok-shops.com/api/v2/token/get

Image 2. Add the query parameters.

Image 3. Send the request. Press Send next to the request URL. If successful, the response should resemble the following: Image 4. Save token variables. The downloaded collection can save token values automatically. If you configure the request manually, add a Postman Tests script like this:

var json = pm.response.json();

if (json && json.data) {
    pm.environment.set("access_token", json.data.access_token);
    pm.environment.set("refresh_token", json.data.refresh_token);
}

For token lifecycle details and refresh-token usage, refer to Generate a test access token.

This section walks through setting up common parameters to call Get Authorized Shops. 1. Open a new request tab. Set the request method to GET and use this request URL:

https://open-api.tiktokglobalshop.com/authorization/202309/shops

Image 2. Add the query parameters.

Image Important: Set sign to {{sign}} and timestamp to {{timestamp}}. If the timestamp is too old, regenerate both timestamp and sign before sending the request. 3. Add the headers.

Image If you press Send before generating sign and timestamp, the API returns a signature error. Continue to Step 3 to automate request signing in Postman.

Calling TikTok Shop OpenAPI requires a request signature. Postman can generate the signature automatically in the Pre-request Script section. For the canonical signing rule, refer to Sign your API request. Important: Do not hardcode a real App Secret in the Pre-request Script. Use YOUR_APP_SECRET only as a placeholder in examples. Do not log the signing string, because it contains the App Secret. Set app_secret in your private Postman environment instead. 1. Set the required environment variables.

2. Add this JavaScript Pre-request Script.

function objKeySort(obj) {
    var newKey = Object.keys(obj).sort();
    var newObj = {};
    for (var i = 0; i < newKey.length; i++) {
        newObj[newKey[i]] = obj[newKey[i]];
    }
    return newObj;
}

function getEnvVar(k) {
    var v = pm.variables.get(k);
    if (v != null) {
        return v;
    }
    v = pm.environment.get(k);
    if (v != null) {
        return v;
    }
    v = pm.collectionVariables.get(k);
    if (v != null) {
        return v;
    }
    v = pm.globals.get(k);
    if (v != null) {
        return v;
    }
    return null;
}

function interpolateVar(value) {
    if (value == null) {
        return "";
    }
    const { Property } = require("postman-collection");
    return Property.replaceSubstitutions(String(value), pm.variables.toObject());
}

function getRequestBody() {
    if (!pm.request.body) {
        return "";
    }

    if (pm.request.body.mode === "raw" && pm.request.body.raw) {
        return interpolateVar(pm.request.body.raw);
    }

    return "";
}

var secret = getEnvVar("app_secret");
if (!secret || secret === "YOUR_APP_SECRET") {
    throw new Error("Set app_secret in your Postman environment. Do not hardcode a real App Secret in the script.");
}

var ts = Math.floor(Date.now() / 1000).toString();
pm.variables.set("timestamp", ts);

function calSign(secret) {
    var queryParam = pm.request.url.query ? pm.request.url.query.members : [];
    var param = {};

    for (var i = 0; i < queryParam.length; i++) {
        var item = queryParam[i];
        if (item.disabled) {
            continue;
        }

        var value;
        if (item.key === "timestamp") {
            value = ts;
        } else {
            value = item.value;
            if (value == null || value === "{{" + item.key + "}}") {
                value = getEnvVar(item.key);
            }
        }

        param[item.key] = interpolateVar(value);
    }

    delete param.sign;
    delete param.access_token;

    var sortedObj = objKeySort(param);
    var signstring = secret + pm.request.url.getPath();
    for (var key in sortedObj) {
        signstring += key + sortedObj[key];
    }
    signstring += getRequestBody() + secret;

    return CryptoJS.HmacSHA256(signstring, secret).toString(CryptoJS.enc.Hex);
}

pm.variables.set("sign", calSign(secret));

For GET /authorization/202309/shops, the request body is empty. For APIs with a JSON request body, set the body to raw JSON before sending the request so the script can include the raw body in the signing string. If your API uses another body mode, follow the body concatenation rule in Sign your API request.

After completing the previous steps, press Send to call Get Authorized Shops. If successful, the response should resemble the following: Image Key response fields: