# TikTok Verification Domain Plan

Sprint: 8.3 — Verification-Ready TikTok Demo Flow

## Problem

TikTok app review expects the web app/domain shown in the verification video to match the website URL submitted for review. The current dashboard preview runs over Tailscale:

```text
http://100.85.29.67:5176/dashboard
```

That is practical for internal work, but it is probably not suitable as the submitted TikTok review domain because it is private/Tailnet-only and not a stable public product URL.

## Option A — Public staging domain for dashboard

Example domains:

```text
https://dashboard.truetraceshorts.com
https://creator.truetraceshorts.com
```

Implementation options:

- Cloudflare Tunnel to the dashboard preview.
- Cloudflare Pages / Worker fronting a deployed dashboard build.
- Small VPS with HTTPS reverse proxy to the dashboard backend/frontend.

Requirements:

- HTTPS.
- Publicly reachable by TikTok reviewers.
- Login-protected, but test credentials can be provided in the review form if needed.
- Creator-facing copy, not internal bot terminology.
- Same domain/URL used in app settings and shown in the verification video.
- No secrets in frontend bundle.
- Backend API CORS configured for the staging origin.
- TikTok redirect/callback URLs match staging domain when Sandbox OAuth is used.

Pros:

- Best match for TikTok review expectations.
- The reviewer sees the same app/domain as submitted.
- Lower risk than showing a private Tailnet IP.

Cons:

- Requires staging deployment setup.
- Requires login/review-access handling.
- Needs domain/CORS/OAuth callback configuration.

## Option B — Record app locally but submit public product website

Example submitted website:

```text
https://truetraceshorts.com
```

or current public product site / Pages URL.

Pros:

- No immediate dashboard deployment.
- Product website may already be public.

Cons / risk:

- The demo video would show the dashboard on a different private/local domain.
- TikTok may reject if the demonstrated web app does not match the submitted Website URL.
- The public product website is not the actual creator workspace using `video.upload`.

## Recommendation

Use **Option A** before submitting TikTok verification:

```text
Create a public staging domain for the dashboard, protected with login, reachable by TikTok reviewers.
```

Recommended domain:

```text
https://dashboard.truetraceshorts.com
```

Do not deploy it automatically in Sprint 8.3. Prepare only the plan and prerequisites.

## Prerequisites before deployment

- Decide final review domain name.
- Configure DNS and HTTPS.
- Add staging origin to backend CORS.
- Add login credentials or a reviewer account flow.
- Configure TikTok Developer app website URL to the same dashboard staging domain.
- Configure TikTok Sandbox OAuth redirect URL to staging callback if Sandbox OAuth is used.
- Run production build and smoke tests.
- Confirm no private secrets/tokens appear in frontend/network logs.
- Confirm website companion pending files remain separate from dashboard deployment.

## Current Sprint 8.3 decision

```text
No dashboard public deployment in this sprint.
No website push.
No TikTok real post.
Mock mode is internal rehearsal only.
Sandbox credentials are required for a stronger final submission recording if available.
```

## Current decision

No additional public dashboard domain will be purchased or configured for the first attempt.

The internal rehearsal and possible first submission recording will use the current dashboard preview.

Known review risk:

- TikTok requests sandbox usage for first-time review.
- TikTok requests the web-app domain shown in the demo to match the submitted website URL.
- Current setup is a Tailnet/internal preview, not a public staging dashboard domain.

Decision:

- Proceed with a best-effort recording first.
- Keep UI focused on the app in fullscreen/browser-app mode.
- Do not claim sandbox or public staging if not true.