Skip to main content

Postman

Postman is a popular online and free API platform for building and using APIs. Postman can be used to accelerate API testing and integration for TikTok Shop APIs.

For your first API request, we strongly recommend calling Get Authorized Shops. The following step-by-step guide assumes you are trying to call Get Authorized Shops.

📌 Note: We also provide a ZIP file that contains both a Postman collection and a set of environment variables if you would like to get up and running as quickly as possible. Fill out the environment variables (app key, app secret, auth token) and call GET Access Token to get your API access token. The post-request script should save this to your variables so you can call subsequent APIs. Click here to download.

Step 1: Obtain an access token

This authorization section will walk you through obtaining an access_token using Postman. For more information on access tokens and required parameters, refer to our authorization guide.

  1. Open a new workbench tab and set the request method to GET. The request URL is:

PLAINTEXTWord Wrap

https://auth.tiktok-shops.com/api/v2/token/get

Image

  1. Set the following parameters:

  1. Press Send next to the request URL. If successful, the response should resemble the following:

Step 2: Set common parameters

This section will walk you through setting up common parameters to call Get Authorized Shops.

  1. Open a new workbench tab and set the request method to GET. The request URL is:

PLAINTEXTWord Wrap

https://open-api.tiktokglobalshop.com/authorization/202309/shops

  1. Set the following parameters:

❗ Important: Ensure sign and timestamp values are correctly set to {{sign}} and {{timestamp}} respectively.

  1. Navigate to the Headers section and add the following header:

📌 Note: If you press Send now, you will encounter a "signature is invalid" error message. To address this, you must generate a request signature. Please proceed to Step 3: Request signature section of this guide to learn how to automate this process in Postman.

Step 3: Request signature

Calling a TikTok Shop API requires you to sign your request, and Postman allows us to automate this process. For more information on API request signatures, refer to Sign your API request.

Open a new workbench tab and navigate to the Pre-request Script section, copy and paste the following Go script:

❗ Important: Ensure you replace the secret with your specific app secret.

GOWord Wrap

// Replace with your app secret  
var secret = "7bf9fa93cd06a160c03f5789be285ac36df8701f"    
    
function objKeySort(obj) {    
    var newKey = Object.keys(obj).sort()    
    var newObj = {}    
    for (var i = 0; i < newKey.length; i++) {    
        newObj[newKey[i]] = obj[newKey[i]]    
    }    
    return newObj    
}    
    
function getEnvVar(k) {    
    var v = pm.variables.get(k)    
    if (v != null) {    
        return v    
    }    
    v = pm.environment.get(k)    
    if (v != null) {    
        return v    
    }    
    v = pm.globals.get(k)    
    if (v != null) {    
        return v    
    }    
    return null    
}    
    
var ts = Date.parse(new Date()) / 1000    
pm.variables.set("timestamp", ts)    
    
calSign = function(secret) {    
    var ts = getEnvVar("timestamp")    
    var queryParam = pm.request.url.query.members    
    var param = {}    
    for (var item in queryParam) {    
        if (queryParam[item].key == "timestamp") {    
            v = ts    
        } else {    
            var v = queryParam[item].value    
            if (v == null || v == "{{" + queryParam[item].key + "}}") {    
                v = getEnvVar(queryParam[item].key)    
            }    
        }    
        param[queryParam[item].key] = interpolateVar(v)    
    }    
    
    delete param["sign"]    
    delete param["access_token"]    
    var sortedObj = objKeySort(param)    
    var signstring = secret + pm.request.url.getPath()    
    for (var key in sortedObj) {    
        signstring = signstring + key + sortedObj[key]    
    }    
    signstring = signstring + interpolateVar(pm.request.body.toString()) +  secret    
    console.log(signstring)    
    sign = CryptoJS.HmacSHA256(signstring, secret).toString()    
    return sign    
}    
    
function interpolateVar (value) {    
    const {Property} = require('postman-collection')    
    return Property.replaceSubstitutions(value, pm.variables.toObject())    
}    
    
var sign = calSign(secret)    
pm.variables.set("sign", sign)

Step 4: Call Get Authorized Shops

If you've correctly followed all previous steps, you're ready to press Send and call Get Authorized Shops. If successful, the response should resemble the following: