TikTok's private mobile API, taken apart.
Reverse-engineered access to TikTok's private mobile API, crawled at billion scale. The teardowns, the datasets, and the tool that does it all live here.
Scraping TikTok's Mobile API
The full write-up: how TikTok signs its private mobile API, device registration and activation, the X-Argus / X-Ladon cipher stack, TLS fingerprinting, and the 24 endpoints it opens up.
Read →Scraping 3 billion TikTok profiles (and what's actually in them)
A run through the shape of the dataset: 3.1 billion unique creators, how many clear the 1k-follower line, and where they are in the world.
Read →How TikTok's X-Argus request signing works
The header that gates the mobile API: a protobuf sealed with two layers of Simon/Speck and SM3. What it contains and why a wrong one returns an empty 200.
Read →Where TikTok hides the creator's country
The profile endpoint returns no region. The author object on a post looks like it should, but it's empty. The country is there, one level up.
Read →