This document provides full technical transparency regarding our internal agency campaign management suite, OAuth 2.0 authorization flows, and strict compliance with TikTok for Business Developer Policies.
Client logs into official TikTok OAuth dialog. Grants scoped permissions: user_info, ad_mgmt, report.
Short-lived auth code exchanged via HTTPS POST for 24-hour Access Token and 30-day Refresh Token. Encrypted at rest via AES-256-GCM.
Dispatches verified video batches. Enforces strict TikTok-only placements (PLACEMENT_TIKTOK). Dynamically calculates Bid Ladder tiers.
Streams deduplicated purchase events back to TikTok Marketing API. Calculates true net CPA and ROAS in 15-minute cycles.
Shugar Engine™ interfaces exclusively with verified, documented endpoints of the official TikTok Business API. All calls pass strict rate limiting and backoff routines.
| Endpoint URI | HTTP Method | Required Scope | Functional Purpose |
|---|---|---|---|
| /open_api/v1.3/oauth2/token/ | POST | user_info | Exchanges OAuth 2.0 authorization code for client access & refresh tokens |
| /open_api/v1.3/smart_plus/campaign/create/ | POST | campaign_mgmt | Initiates Upgraded Smart+ 2027 campaigns with objective: CONVERSIONS |
| /open_api/v1.3/smart_plus/adgroup/create/ | POST | campaign_mgmt | Configures adset targeting, strict Only-TikTok placement, and Bid Ladder step |
| /open_api/v1.3/smart_plus/ad/create/ | POST | creative_mgmt | Uploads and bundles up to 10 unique video creatives into 1 Smart+ container |
| /open_api/v1.3/reports/integrated/get/ | GET | reporting | Queries retention metrics (6s watched, 100% completion) and conversion ROI |
| /open_api/v1.3/pixel/batch/ | POST | event_mgmt | Server-to-Server Conversion API (CAPI) real-time event streaming with SHA-256 hash |
Shugar Media B.V. operates with strict adherence to TikTok Commercial Platform Terms, European GDPR / AVG provisions, and ISO/IEC 27001 data isolation best practices.
We never solicit, store, or log client TikTok or ByteDance account passwords. All access is granted via tokenized OAuth 2.0 authorization codes and can be revoked by the client at any time in their TikTok Business Center settings.
Our systems do not scrape, harvest, or reverse-engineer user profiles. All media buying is conducted through documented programmatic APIs for legitimate commercial advertisers.
Shugar Media B.V. is registered in Amsterdam (KvK 89412085) and maintains an appointed Data Protection Officer reachable at privacy@shugar-media.digital.