Using internal TikTok Live API

[Andrey4ik21pro1]

Hello everyone.
I have my own Telegram bot that uses this library to watch TikTok live streams without logging into an account and to read live chat messages. As far as I understand, chat support is one of the more complex parts to implement, but that’s not the main point here.

The issue is that some live streams have an age restriction (18+), so I needed to try to work around this limitation.

While exploring the TikTok Live Recorder repository, I found usage of the TikRec API, specifically this code:

self.TIKREC_API = "https://tikrec.com"

def _tikrec_get_room_id_signed_url(self, user: str) -> str:
    response = self.http_client.get(
        f"{self.TIKREC_API}/tiktok/room/api/sign",
        params={"unique_id": user},
    )

    data = response.json()
    signed_path = data.get("signed_path")
    return f"{self.BASE_URL}{signed_path}"

Out of curiosity (and a bit of desperation), I then made a direct curl request with the required parameter and received a response like this:

{
  "signed_url": "https://www.tiktok.com/api-live/user/room/?uniqueId=XXX&sourceType=54&aid=1988&X-Bogus=...",
  "signed_path": "/api-live/user/room/?uniqueId=XXX&sourceType=54&aid=1988&X-Bogus=..."
}

After opening the signed_url, I was able to retrieve a lot of useful information. It turns out this is an internal TikTok Live API that is used by the official TikTok application itself.

To be clear: I was not able to bypass the 18+ age restriction.
However, this API might still be useful as a fallback or alternative to the Webcast API.

Another interesting observation is that this API returns what appears to be the actual viewer statistics for a live stream:

"liveRoomStats": {
  "enterCount": 1867,
  "userCount": 147
}

• userCount seems accurate and matches the real concurrent viewers
• enterCount is unclear — possibly the total number of joins?

Additional notes

• The X-Bogus parameter is not mandatory — the API still returns data without it.
• I also found a generator for this parameter:
  https://github.com/iamatef/xbogus
  At the moment, I don’t fully understand its purpose or how it affects the request.

P.S.

This API also appears to be usable for parsing regular (non-live) videos, for example:
https://www.tiktok.com/api/user/detail/?aid=...

[isaackogan]

You can only get around 18+ age restriction with an 18+ sessionId. It really is that simple & cannot be bypassed as far as I understand. Also, /api-live is used by this library, or if not this then at least one of the others, and does not require signatures at the moment.

[Andrey4ik21pro1]

@isaackogan Where does this library use the /api-live? If it’s only in some places, then you misunderstood me. I mean making it possible to choose which API to use.