TikTok custom-auth OAuth2 token exchange fails: access_token missing after successful consent

[Peragrin]

SDK Language

TypeScript / Node.js SDK (@composio/core)

SDK Version

N/A — calling Composio REST API v3 directly (no SDK): POST /api/v3/auth_configs and POST /api/v3/connected_accounts/link

Runtime Environment

Node.js v26 on macOS (server calls Composio REST via fetch)

Environment

Local Development

Describe the Bug

Connecting a custom-auth (OAUTH2) account for the tiktok toolkit fails at the token-exchange step, immediately after a successful user consent. TikTok is not Composio-managed (COMPOSIO_MANAGE_CONNECTIONS returns "Composio does not manage auth for toolkit tiktok"), so use_custom_auth is the only option.

After the user approves the TikTok consent screen (all requested scopes shown correctly), the callback fails with:

Failed to connect Composio to Tiktok
Invalid OAuth2 token exchange response:
[{ "code": "invalid_type", "expected": "string", "received": "undefined",
   "path": ["access_token"], "message": "Required" }]

TikTok's token endpoint returns no access_token, so Composio's response validation fails. Reproduces identically every attempt.

Likely cause: TikTok's OAuth is non-standard — its token endpoint (https://open.tiktokapis.com/v2/oauth/token/) requires client_key (NOT the standard client_id) and returns access_token at the top level. It looks like the custom-auth OAUTH2 flow posts client_id, so TikTok returns an error object (no token) and the parser then fails on the missing access_token.

Steps to Reproduce

1. Create a custom-auth config for TikTok: POST /api/v3/auth_configs with { toolkit: { slug: "tiktok" }, auth_config: { type: "use_custom_auth", authScheme: "OAUTH2", name: "...", credentials: { client_id, client_secret, scopes: "user.info.basic,user.info.profile,user.info.stats,video.list", oauth_redirect_uri: "https://backend.composio.dev/api/v3.1/toolkits/auth/callback" } } } (own TikTok dev app; redirect URI registered on the app; sandbox with the account added as a target user).
2. Initiate the connection: POST /api/v3/connected_accounts/link with { auth_config_id, user_id } and open the returned redirect_url.
3. Approve the TikTok consent screen (all 4 scopes are shown correctly).
4. Observe the callback fail with the "Invalid OAuth2 token exchange response ... access_token Required" error above.

Expected: the connection completes and TIKTOK_GET_USER_STATS / TIKTOK_LIST_VIDEOS become callable for the user.
Actual: token exchange fails; no connected account is created.

Minimal Reproducible Example

# 1) Create custom-auth config (TikTok is not Composio-managed)
curl -X POST https://backend.composio.dev/api/v3/auth_configs \
  -H "x-api-key: $COMPOSIO_API_KEY" -H "Content-Type: application/json" \
  -d '{"toolkit":{"slug":"tiktok"},"auth_config":{"type":"use_custom_auth","authScheme":"OAUTH2","name":"TikTok","credentials":{"client_id":"<tiktok_client_key>","client_secret":"<secret>","scopes":"user.info.basic,user.info.profile,user.info.stats,video.list","oauth_redirect_uri":"https://backend.composio.dev/api/v3.1/toolkits/auth/callback"}}}'
# -> 201, returns auth_config id ac_xxx

# 2) Initiate connection, then open redirect_url and approve TikTok consent
curl -X POST https://backend.composio.dev/api/v3/connected_accounts/link \
  -H "x-api-key: $COMPOSIO_API_KEY" -H "Content-Type: application/json" \
  -d '{"auth_config_id":"ac_xxx","user_id":"default"}'
# -> 201, returns redirect_url -> approve -> callback fails at token exchange

Error Output / Stack Trace

Shown on the Composio connect callback page after approving the TikTok consent:

Failed to connect Composio to Tiktok
We couldn't connect your Tiktok account to Composio. Please try again.

Invalid OAuth2 token exchange response: [ { "code": "invalid_type", "expected": "string", "received": "undefined", "path": [ "access_token" ], "message": "Required" } ]

Reproducibility

• Always reproducible
• Intermittent / Sometimes
• Happened once, can’t reproduce

Additional Context or Screenshots

• The consent screen renders correctly with the right app name and all requested scopes, so the authorize step is fine — only the server-side token exchange fails.
• Scopes requested: user.info.basic, user.info.profile, user.info.stats, video.list.
• Happy to share the auth_config id and TikTok client key privately to help reproduce (omitting them here). No SDK involved — calling the REST API directly.

[github-actions]

🤖 Automated Claude triage note: this does not look like an SDK bug, so I've labeled it as support for support team follow-up. Claude cannot reply back in a conversation.

[aaditya755]

Hi I want to work on this issue can you please assign me this issue

[sohambasu963]

Thanks for the detailed report. We checked the current OAuth flow and it already sends TikTok’s required client_key using a form-encoded token request, so the proposed client_id cause is not confirmed.

The error indicates that TikTok returned a response without an access_token, but it does not reveal the underlying provider error. Please send the auth config ID and exact UTC failure time through Composio support at support@composio.dev Do not include your client secret. We can then determine whether TikTok rejected the app configuration or whether the connector needs a change.

[Peragrin]

Thanks for getting back to me.. I have switched to another provider for now so no need to to keep this ticket open.Kind regards,Rupert H RhodesOn 26 Aug 2026, at 23:53, Soham Basu ***@***.***> wrote:sohambasu963 left a comment (ComposioHQ/composio#4198) Thanks for the detailed report. We checked the current OAuth flow and it already sends TikTok’s required client_key using a form-encoded token request, so the proposed client_id cause is not confirmed. The error indicates that TikTok returned a response without an access_token, but it does not reveal the underlying provider error. Please send the auth config ID and exact UTC failure time through Composio support at ***@***.*** Do not include your client secret. We can then determine whether TikTok rejected the app configuration or whether the connector needs a change. —Reply to this email directly, view it on GitHub, or unsubscribe.Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[sohambasu963]

Sounds good, we'll close this issue for now then, but feel free to email us at support@composio.dev if you require support from us in the future.