TikTok Ads MCP · hosted OAuth
Connect TikTok Ads to an AI client without building an app
NotFair hosts TikTok Ads OAuth. You authorize advertiser accounts without building a TikTok developer app for the MCP client.
Last verified · September 17, 2026 · NotFair product team
Two identities, one flow
OAuth identifies the user; the hosted integration identifies the app
Self-hosted servers make the operator own both layers. A hosted server separates them: NotFair maintains the TikTok Ads application integration, while the customer grants scoped access as the account owner.
- 01
Add the hosted MCP URL
Use the same Streamable HTTP endpoint in Claude Web, Claude Code, Codex CLI, Cursor, OpenClaw, Hermes, or another compatible client.
- 02
The client discovers OAuth metadata
The MCP resource advertises its authorization server. Discovery uses the exact apex or www origin requested so the issuer remains byte-for-byte consistent.
- 03
Sign in and authorize TikTok Ads
The browser-facing flow asks the account owner to approve access. Passwords are never pasted into the MCP client.
- 04
Choose eligible accounts
NotFair lists reachable accounts for the authorized user. The user chooses the intended scope.
- 05
Return to the AI client
The client completes its OAuth code exchange. Platform credentials stay on the hosted service.
- 06
Verify with a real read
Ask the agent to list connected TikTok Ads accounts, then inspect one entity before staging any write.
Evidence table
Hosted OAuth versus self-hosting
| Responsibility | NotFair hosted MCP | Self-hosted TikTok Ads MCP |
|---|---|---|
| Provider application | Operated by NotFair | Created and maintained by your team |
| OAuth application | Hosted authorization flow | Your team creates credentials and redirect URIs |
| MCP runtime | Remote Streamable HTTP endpoint | Local or cloud process you deploy |
| Account consent | Customer still approves provider access | Customer approves access to your OAuth app |
| Secrets | Platform tokens remain server-side | Your team stores and rotates credentials |
| Updates | Service maintained by NotFair | Your team tracks API and MCP changes |
Limits and honest boundaries
- The TikTok Ads user still needs legitimate access to the accounts they select.
- Hosted OAuth removes customer infrastructure work; it does not bypass provider permissions, policies, or API restrictions.
- Claude, Codex, and other clients may present connector settings differently even though the remote MCP URL is the same.
- The apex endpoint is canonical for new connections; www remains supported so existing OAuth grants keep working.
Frequently asked questions
No. NotFair hosts TikTok Ads OAuth. You authorize advertiser accounts without building a TikTok developer app for the MCP client.
No. The hosted service keeps platform credentials server-side. The MCP client receives tools and results, not your password or raw refresh token.
Yes. The apex origin is canonical for new setup, while both origins remain valid OAuth and MCP resources for backward compatibility.
The pattern is the same — NotFair hosts the application credentials — but Google Ads developer tokens are specific to Google Ads. This page is about TikTok Ads OAuth only.
Continue evaluating