# TikTok app review + TrueTraceShorts domain verification notes

Use this when preparing TikTok Developer App review material or verifying the TrueTraceShorts website/domain for TikTok.

## Public vs internal boundary

Public website pages should mention TikTok only generically as a third-party social platform if needed. Do not publish implementation details such as:

- TikTok OAuth scopes or token handling;
- `video.upload`, `video.publish`, upload status, publish ID, open ID;
- draft/in-app review flow specifics;
- access tokens, refresh tokens, client secrets, callback URLs, internal approval commands, or internal automation pipelines.

Put those details only in internal docs such as `docs/tiktok-app-review-notes.md`, and never include secrets.

## TikTok review posture

For the user's TrueTraceShorts setup, keep the app-review explanation narrow and safety-oriented:

- Product: Content Posting API.
- Scope: `video.upload` only.
- Upload endpoint to demonstrate: `/v2/post/publish/inbox/video/init/`.
- Upload source for local/dashboard demo: `FILE_UPLOAD` (URL pull requires verified domain/prefix).
- Show Upload Draft / inbox-notification flow, not Direct Post.
- No `video.publish` / Direct Post.
- No comments.
- No analytics.
- No messaging.
- No user contact feature.
- Content: approved educational short videos about scam red flags and online safety.
- Uploaded videos are for creator review/manual posting, not direct public publishing.

## Dashboard verification demo pattern

Use this for the AutoShorts Dashboard TikTok verification sprint/workflow:

- Current product rule: automatic TikTok upload and TikTok mock-demo recording are paused unless the user explicitly re-approves that direction.
- Review page TikTok workflow is manual export only: playable video, editable TikTok caption/hashtags, Download MP4, Copy caption/hashtags, synthetic-media reminder, Mark as exported for TikTok, optional Mark manually posted / TikTok link capture.
- Do not put TikTok Sandbox/Mock/API upload/readiness copy in the main creator workflow. Historical `/verification` or logs may remain for audit/internal context, but navigation/dashboard/review should not promote it.
- Keep TikTok Direct Post disabled. Copy should never imply the Dashboard posts publicly to TikTok.
- YouTube remains the automated platform path: private upload only, explicit creator confirmation, no website push, no public/unlisted upload in MVP.
- If Dashboard OAuth is missing, expose a token-free UploadRequest/outbox for the existing Jarvis uploader rather than pretending a direct YouTube API upload is possible.
- Public-facing/product copy should call the dashboard a `Creator review and publishing workspace for prepared short-form videos`, not Jarvis bot/internal uploader/private automation utility.

Reusable short app description options:

```text
Uploads approved short videos for review and manual posting by the channel owner.
```

```text
Helps manage educational short videos about scam red flags and online safety.
```

## Domain verification file workflow

If TikTok provides a verification TXT file, host it as a root static asset in the Astro website repo:

```text
public/<tiktok-verification-file>.txt
```

Then verify it appears at:

```text
https://truetraceshorts.pages.dev/<tiktok-verification-file>.txt
```

Steps:

1. Retrieve the exact TXT file from Drive or the platform-provided source.
   - If using `gog`, search broadly if exact Drive query returns `[]` because filename queries can miss newly uploaded/shared files:
     ```bash
     export GOG_KEYRING_PASSWORD=...  # from runtime secret/profile, never print it
     gog -a friday.uplink@gmail.com drive search tiktok
     gog -a friday.uplink@gmail.com drive download <file_id> --output /tmp/<filename>.txt
     ```
   - Do not paste the token contents into chat unless needed; length/line-count/ASCII checks are enough.
2. Confirm it is small/plain text and contains only the expected verification token.
3. Copy to the Astro repo's `public/` directory with the exact filename.
4. Run `npm run build` and confirm `dist/<filename>.txt` byte-matches `public/<filename>.txt`.
5. Run `npm run qa:production`; optionally `npm run qa:live` after push.
6. Commit and push to the Cloudflare Pages production branch.
7. Poll the live URL until it returns 200 and byte-matches the local file. Cloudflare Pages may initially return 404 while deploying; retry rather than assuming failure after the first 404.

Do not expose or log OAuth credentials while performing domain verification; the TXT token itself is public by design once hosted.