Douyin and TikTok data API, self-hosted

20.4kGitHub stars2,830forks177kDocker pullsv5.1.2latest release4years maintained

Figures read 2026-09-28. Built into the page, not fetched from it.

There is a live instance you can sign in to

demo.douyin.wtf runs this software and is open to everyone. The login page fills in the demo account for you — no registration, no key, nothing to install. How to use it.

What it is

Douyin_TikTok_Download_API is an open-source, self-hosted data API for Douyin (抖音) and TikTok. You run it on your own machine with one docker compose up. There is no hosted tier, no signup and no quota, and nothing is proxied through anybody else’s server.

It fetches posts, authors, comments, mixes and search from both platforms, and it downloads video and image albums without a watermark — it selects the clean stream the platform already publishes rather than stripping anything. What it collects is archived in your own PostgreSQL, so a post deleted upstream is still readable locally.

It handles the awkward parts rather than leaving them to you: Douyin’s a_bogus and X-Bogus request signatures and TikTok’s are implemented natively in Python, short links are expanded and checked against an allowlist before anything is fetched, and a post id is validated against the platform’s own encoding so an id that cannot exist never costs an upstream request.

Three entry points, one service layer

A REST API with 93 operations, an MCP server for AI agents, and a dtk CLI. MCP is not a wrapper around HTTP: all three call the same service layer, so a tool call skips the second hop and the second authentication.

Cookies stop being a chore

A headless browser mints guest identities on a timer. The pool tests, cools and retires them on its own. Your own logged-in cookies are an optional upgrade, not a requirement.

Signing is native Python

a_bogus, X-Bogus and the TikTok signatures run in-process in microseconds. The browser stays as a fallback and as a drift detector — it is how the instance notices the platform changed its algorithm.

It tells you when it is unwell

Every request is logged with structure. Every identity and every endpoint carries a live health score. Risk-control signals trip a circuit breaker before the pool burns down.

Try it without installing anything

In the browser

1. Open demo.douyin.wtf. The login page arrives with the demo account already filled in.
2. Sign in. You land in the console as a demo role.
3. Go to Playground, paste any Douyin or TikTok link, and press Parse.

From a terminal

Nothing to register for: the instance publishes its own demo password at /api/v1/auth/demo. The session is a cookie, not a bearer token.

PASS=$(curl -s https://demo.douyin.wtf/api/v1/auth/demo | jq -r .data.password)

curl -s -c jar -o /dev/null \
  -X POST https://demo.douyin.wtf/api/v1/auth/login \
  -H 'content-type: application/json' \
  -d "{\"username\":\"demo\",\"password\":\"$PASS\"}"

curl -s -b jar -X POST 'https://demo.douyin.wtf/api/v1/parse?wait=25' \
  -H 'content-type: application/json' \
  -d '{"url":"https://www.douyin.com/video/7675505205047348543"}' \
| jq '.data | {platform, kind, description}'

?wait=25 is what makes the call synchronous: it holds the connection until the task finishes and answers 200 with the result. Leave it off and you get 202 with a task id instead, which is the normal asynchronous path. The ceiling on this instance is 30 seconds.

The reference is open without a login too — /swagger, /redoc and /openapi.json, in both languages.

What the demo is and is not

It is one small server, shared by everyone, so it is rate-limited to 30 requests per 10 seconds; going over puts you in a 10-second cooldown where every request is refused. That is the demo’s limit, not the software’s.

The demo role reads. It cannot manage identities, edit settings, create keys or start downloads, and explain and identity in the Playground are operator-only because both hand back a live credential. Anything you do there is visible to whoever looks next — treat it as a public sandbox, and do not paste a cookie into it.

Common questions

Is this legal?What the licence says, what it does not cover, and whose responsibility the answer is.

Can it download without a watermark?Yes, when the platform serves one — and an exact account of what that means.

Do I need cookies from my own account?No. Guest identities are minted for you; your own cookies widen what you can see.

Do I need proxies?It depends entirely on your throughput. The honest version, with numbers.

Does it support Bilibili, Xiaohongshu, Kuaishou or Weibo?Not yet, and why the architecture leaves room for them.

Who pays for this

Sponsor

TikHub.io

Your ultimate social media data & API marketplace

Professional data for Douyin, TikTok, Xiaohongshu, Instagram, YouTube and Twitter. Real-time endpoints, flexible APIs, competitive pricing. If you would rather buy the data than operate a pool, start here.

Visit TikHub.io · API docs · Sponsor this project

TikHub pays to be on this page, and this project stays free and Apache-2.0 because of it. That is the whole arrangement: no paid tier here, no feature held back, nothing that stops working if you never click it.

Community

reer.dev

A forum for reverse engineering

Somewhere to put what you work out. This project exists because people wrote down how a signature was built; the forum is for the next round of that — signatures, protocols, packers, anything taken apart. Free, no advertising, English and Chinese, nothing gated.

Open reer.dev

Run your own

Docker

git clone https://github.com/Evil0ctal/Douyin_TikTok_Download_API.git
cd Douyin_TikTok_Download_API
cp .env.example .env          # then set DTK_SECRET_KEY
COMPOSE_ENV_FILES=.env docker compose -p dtk -f docker/compose.yml up -d

Open http://localhost:8000 and finish the setup in the browser. The long version is in the quick start.

Guided installer

A bash script that works out your distribution, offers the right way to install Docker, scales the container limits to the machine, generates secrets and brings the stack up. Run it again afterwards and it becomes the operations menu: status, upgrade, passwords, backups, settings, disk.

bash <(curl -fsSL https://raw.githubusercontent.com/Evil0ctal/Douyin_TikTok_Download_API/main/install/install.sh)

There is a Chinese edition at install/install.zh.sh. Both are documented in installation and deployment.

Quick startThe stack running on one host, an administrator account, and one link parsed — about ten minutes.

Installation and deploymentThe compose file service by service, every variable, reverse proxies, and running without Docker.

REST API guideAuthentication, the response envelope, the asynchronous task model, paging and errors.

MCP and AI agentsPoint Claude Code, Claude Desktop or any MCP client at your own instance.

---

Apache-2.0. Source, issues and releases on GitHub · try it at demo.douyin.wtf · read it in 简体中文.