TikTok Auto Uploader GitHub Repos: The Cookie File Is the Real Risk, Not the Script

You search for a TikTok auto uploader GitHub project and find one with a clean README and a few thousand stars. Step one of the setup says: install a browser extension, export your cookies to a text file, and point the script at it. That step is the whole security model of the tool, and most people do it in under a minute.

The script itself is rarely the problem. What you hand it is. This piece sorts the uploader repos by the credential they need, quotes what TikTok's own developer documentation says about each route (fetched on 17 September 2026), and ends with a table you can use to pick one without learning the hard way.

Every TikTok auto uploader GitHub repo starts by asking for a key

We looked at the repos that currently lead a search for this phrase. Strip away the language and framework differences and they sort into two families, with the second one splitting into three mechanisms:

• Official API clients. They use TikTok's Content Posting API. You register a developer app, a user authorises it, and the tool holds an access token with a defined scope.
• Session drivers. They act as you, inside a session you already logged into:
  • Browser automation with exported cookies (Playwright or Selenium drive a real browser page).
  • Raw HTTP requests with reverse-engineered signatures (no browser; the tool imitates what the web app sends).
  • Phone automation over ADB (a script taps through the TikTok app on an Android device or emulator).

Our earlier look at TikTok automation on GitHub in general covered why API clients hit quotas and browser drivers hit a maintenance curve. For uploaders specifically, the more useful question is narrower: what is the thing you are handing over, and what can someone do with it?

An uploader script is a few hundred lines of code you can read. The cookie file it asks for is your entire account, and you cannot read what happens to it after it leaves your machine.

Family one: the official Content Posting API is honest, and private until audited

TikTok's developer documentation is unusually direct about the limits here. From the Direct Post reference, fetched 2026-09-17:

• Rate: "Each user access_token is limited to 6 requests per minute."
• Visibility: "All content posted by unaudited clients will be restricted to private viewing mode." The error list adds a sharper version: "Unaudited clients can only post to a private account."
• Daily cap: the error spam_risk_too_many_posts is described as "The daily post cap from the API is reached for the current user." The page does not state the number. Figures circulating in blog posts are not on this page, so we do not repeat them.
• App-wide cap: reached_active_user_cap, "The daily quota for active publishing users from your client is reached."

The getting-started page spells out the way off private mode: "your API client must undergo an audit to verify compliance with our Terms of Service," and Direct Post needs the video.publish scope.

There is a gentler second mode. The upload reference describes a flow to "upload a video without posting it". The video lands in the creator's TikTok inbox and the creator finishes the post in the app. It has its own ceiling: "There may be at most 5 pending shares within any 24-hour period."

What this means for a GitHub repo in this family: if you register your own app and skip the audit, every upload works and nobody sees it. That is the single most common source of "the uploader worked but I got zero views" reports. It is not throttling. It is documented behaviour. We go deeper on that in the TikTok API posting limit breakdown.

Family two: session-cookie uploaders, and what a sessionid actually is

The session drivers exist because the audit is slow or out of reach for a hobby project. Their READMEs are candid about how they work:

• The Playwright-based tiktok-uploader: "Authentication uses your browser's cookies. This workaround was done due to TikTok's stricter stance on authentication by a Playwright-controlled browser." Its author also warns: "the video will fail to upload after too many uploads."
• The requests-based TiktokAutoUploader stores sessions in a local cookies folder and ships a signature generator. Its disclaimer: "usage of such tools may ban your account. Please use at your own risk."
• The ADB-based tiktok-uploader is labelled "For educational purposes only". Its troubleshooting asks you to update resource IDs when the script stops completing, which is what happens after an app update.

Here is the part the READMEs do not dwell on. A session cookie is not a password, it is a logged-in session. Anyone who has a valid one can act as you without a password prompt or two-factor check until that session expires or is revoked. So the practical risks are about custody:

• The file travels. Pasted into a cloud notebook, committed to a fork by accident, synced to a shared drive: each copy is a working login.
• Forks change. A popular uploader gets forked hundreds of times. The fork you cloned is not the repo you read the stars on.
• Signature code is opaque. A bundled signature generator is exactly the part you are least likely to read, and it runs with your session.

What do TikTok's terms say? We read the US Terms of Service (last updated 15 July 2026) today. To be precise about it: the text explicitly bars scraping or extracting content "using any automated system or software, including automated 'bots'" without approval, and bars attempts to "reverse engineer, disassemble, or decompile the Platform" without written authorisation. It also says: "Do not give others access to your account, or transfer your account to anyone else, without our permission." It does not name automated uploading as such. The two clauses that do bite are the reverse-engineering clause (relevant to signature-generating repos) and the account-access clause (relevant the moment your cookie file is on someone else's server). Terms differ by region, so read the version for yours.

A decision table: pick by what you are willing to hold

If what you actually want is to publish a batch of videos, not to maintain code, note that TikTok offers no bulk button at all, for reasons we covered in bulk uploading to TikTok. Every route in this table is a workaround for that design choice.

A ten-minute audit before you run any uploader repo

1. Find the credential line. Search the README for token, cookie, sessionid or adb. That word tells you which row of the table you are in.
2. Find where it is stored. A path in the repo folder means one careless commit publishes your login. Move it outside the project and add it to your ignore file.
3. Check for network calls you did not expect. Search the code for any domain that is not TikTok's. An uploader has no reason to talk to a third server.
4. Read the failure path. What does the script do when an upload is refused? A tool that silently retries in a loop turns one refusal into a pattern.
5. If it is an API client, check the audit status and privacy value. If the app is unaudited, expect private posts and do not diagnose "zero views" as a shadowban.
6. Test on a throwaway video first, and confirm visibility from a logged-out browser.
7. Know how to revoke. For cookie routes, logging out of that session is the kill switch. Do it the day you stop using the tool.

A third option for people who want publishing without owning a script: tools that run the upload inside your own local browser, logged into your own account, so no cookie file is exported and no password is handed over. NoobClaw's video publishing works that way, with each account in its own browser profile. It does not change what TikTok's rules allow; it only removes the custody problem this article is about.

FAQ

Why does my TikTok auto uploader post videos nobody can see?

If it uses the official API, the most likely reason is documented: "All content posted by unaudited clients will be restricted to private viewing mode." Check whether the developer app has passed TikTok's audit before you look for any other cause.

Is using a cookie-based uploader against TikTok's terms?

The US terms we read today do not name automated uploading. They do prohibit reverse engineering without authorisation and giving others access to your account. A repo that generates request signatures, or a hosted service holding your session, runs into those clauses. Running a browser automation on your own machine with your own session is a greyer area, and the READMEs themselves warn about upload failures and possible bans.

How many videos a day can an uploader post?

TikTok documents a daily API post cap per user but does not publish the number. It does publish the rate (6 requests per minute per token) and, for the inbox flow, 5 pending shares per 24 hours. Session-based tools have no published limit at all; their authors report failures after heavy use, which is the practical ceiling.