๐ A self-hosted data API for Douyin, TikTok and Bilibili. One docker compose up, an identity pool that maintains itself, and a REST API, MCP server and web console on top.
Open source, free, and it runs on your own machine โ no signup, no quota, nobody else in the path. It fetches posts, authors and comments, sounds, hashtags, live rooms, trending boards and search results, downloads video and image albums without a watermark (it picks the clean stream the platform already publishes rather than stripping anything), and keeps what it collects in your own PostgreSQL. A video it has downloaded can be turned into text on the same machine, offline, and an AI agent can drive all of it over MCP.
These sponsors paid to be here, and Douyin_TikTok_Download_API stays free and open because of it. To sponsor the project, see my GitHub Sponsors page.
Your Ultimate Social Media Data & API Marketplace
Professional data solutions for Douyin, Xiaohongshu, TikTok, Instagram, YouTube,
Twitter, and more.
Real-time Data | Flexible APIs | Seamless Integration | Competitive Pricing with Discounts
Buy and sell custom APIs, services, and social media solutions on the
TikHub.io Marketplace, alongside developers, businesses and content creators.
Trusted by leading global influencer marketing and social media intelligence platforms
โ Visit TikHub.io ย ยทย API docs
Somewhere to put what you work out. This project exists because people wrote down how a signature was built; the forum is for the next round of that โ signatures, protocols, packers, anything taken apart.
Free, no advertising, and close to no rules beyond the obvious. Bilingual, English and Chinese. Register and post; nothing is gated.
One real call: paste a link, send it, get the normalised result back. The identity pool, the scheduler and the API reference it passed through on the way are all in the same console. The interface follows the browser's language, and both are written by hand rather than machine-translated. ไธญๆ็้ข
https://demo.douyin.wtf is a live instance, open to everyone. Sign in โ the login page fills the demo account in for you โ and use the console: the playground, the scheduler, the library, the API reference. The same account comes with an API key you can call the scraping endpoints with, shown in plaintext on the API keys page.
It is read-only. Demo requests are not written to the request log or the archive, so the database of a public instance cannot be filled by strangers, and switching demo mode off ends every demo session and kills the key immediately.
Rate limit: 30 requests per 10 seconds. Go over it and you are cooled down for 10 seconds, during which every request is refused. It is a shared instance, and the identity pool behind it is the ceiling for everybody using it at once.
What the demo is for is deciding whether to run your own. It is not a service to build on โ it can go down, be reset, or be switched off, and none of that will be announced.
v5 is a rewrite. It started from an empty branch and inherits no v4 code.
v4's real problem was never a shortage of features โ it was that the API would die quietly and nobody would know. A cookie expires, a signature algorithm changes, an endpoint gets rate-limited, and you find out when someone files an issue. v5 puts "you can see it" and "it heals itself" ahead of features.
| v4 | v5 | |
|---|---|---|
| Where identities come from | You copy cookies out of a browser into config.yaml |
A headless browser mints guest identities, and the pool tops itself up when usable ones run low |
| How requests go out | Straight out, as they arrive | Health tiers, quantised LRU rotation, one in-flight lock per identity, a token bucket per (identity, endpoint), a circuit breaker per endpoint |
| When something breaks | You wait for a bug report | One structured record per request, live health for every identity and endpoint, visible in the console |
| Call style | Synchronous โ send and wait | Asynchronous by default (202 + task_id); add ?wait= to go back to synchronous |
| What is kept | Nothing; parsed and discarded | PostgreSQL + Redis. Everything parsed is archived, so a post deleted upstream is still here |
| Access control | None; anyone can call it | API keys with scopes and roles, managed in the console |
| Interface | A single PyWebIO page | A React console: identity pool, scheduler, library, downloads, logs, diagnostics |
| Ways in | REST | REST, MCP and a CLI, all over the same service layer |
| Signing | X-Bogus, A_Bogus | a_bogus, X-Bogus, X-Gnarly, X-Dynosaur and Bilibili's WBI in pure Python, with a browser fallback |
| Deployment | pip install -r requirements.txt + python start.py |
docker compose up, three images |
| Platforms | Douyin, TikTok, Bilibili | Douyin, TikTok, Bilibili |
Bilibili was the one thing that went backwards in 5.0, because it shares neither the signing nor the identity machinery with Douyin and TikTok. It is back in 5.1.6, with the two pieces of its own that needed writing: its WBI signature in pure Python, and guest identities minted over plain HTTP, so a Bilibili pool needs no browser container.
v4's code stays on the v4 branch,
the image is still published, and one command brings it up:
docker run -d --name dtk-v4 --restart unless-stopped \
-p 8080:80 evil0ctal/douyin_tiktok_download_api:V4.1.2Then open http://localhost:8080; the API reference is at /docs. Port 8080 is
deliberate โ v5 binds 8000, so the two versions can run side by side on one machine.
Replace the Douyin cookie before you use it. v4 has no identity pool, and the cookie
baked into the image expired long ago, so Douyin endpoints answer 400 until you put
your own in:
docker cp dtk-v4:/app/crawlers/douyin/web/config.yaml ./douyin-web.yaml
# replace the Cookie line with one from your browser, then save
docker rm -f dtk-v4
docker run -d --name dtk-v4 --restart unless-stopped -p 8080:80 \
-v "$PWD/douyin-web.yaml:/app/crawlers/douyin/web/config.yaml" \
evil0ctal/douyin_tiktok_download_api:V4.1.2TikTok's two config files are at /app/crawlers/tiktok/web/config.yaml and
/app/crawlers/tiktok/app/config.yaml, and are mounted the same way.
To keep it under Compose instead, one file is enough โ with douyin-web.yaml already
copied out next to it, or Docker will create a directory under that name and the app
will fail to read its config:
# compose.yml
services:
app:
image: evil0ctal/douyin_tiktok_download_api:V4.1.2
container_name: dtk-v4
restart: unless-stopped
ports:
- "8080:80"
environment:
TZ: Asia/Shanghai
volumes:
- ./douyin-web.yaml:/app/crawlers/douyin/web/config.yamldocker rm -f dtk-v4 # the container from the run above holds the name
docker compose -p dtk-v4 up -dmain is v5 now and latest is the newest v5 release โ it moves when a release is cut, never
on a push to main โ so pin the tag to stay on v4. V4.1.2 is the last v4 release; the
branch merged a few PRs after it (Bilibili downloads, cookie hot-reload), and that code is
published under the commit tag 5be4838.
There is no guided installer for v4 โ the script in Quick start below installs v5. What is above is all v4 gets: the branch still takes PRs, but nothing new is built on it, and a fresh install should start on v5.
There are a few group chats around my open-source projects. If you want to work
on this one, or just talk shop, add me on WeChat at Evil0ctal with the note
github ไบคๆต and I will add you.
The groups are for learning from each other. No advertising and nothing illegal โ they are for making friends and talking about the work.
| Capability | Douyin | TikTok | Bilibili |
|---|---|---|---|
| One post (video or image album) | โ | โ | โ |
| Author profile | โ | โ | โ |
| An author's posts | โ | โ | โ |
| An author's liked posts | โ | โ | โ |
| Mixes / playlists / seasons, and an author's list of them | โ | โ | โ |
| Comments | โ | โ | โ |
| Comment replies | โ | โ | โ |
| Public folders and what is in them | โ | โ | โ |
| A video's parts, for one uploaded in several | โ | โ | โ |
| The site's popular boards: hot, weekly, all-time picks, top 100 | โ | โ | โ |
| Followers | โ | โ | โ |
| Following | โ | โ | โ |
| Posts recommended beside a post | โ | โ | โ |
| A sound, and the posts that use it | โ | โ | โ |
| A hashtag | โ | โ | โ |
| The posts under a hashtag | โ | โ | โ |
| Keyword search: posts and accounts | โ | โ | โ |
| A live room: whether it is on, and its pull URLs | โ | โ | โ |
| A live room by its broadcast's own id, and Douyin app share links | โ | โ | โ |
| Whether many live rooms are on air, in one call | โ | โ | โ |
| A live room's audience ranking | โ | โ | โ |
| Trending boards | โ | โ | โ |
Douyin serves its follower and following lists only to a signed-in session, so those two endpoints are not registered at all: an endpoint that always returns an empty page is worth nothing. Search and the posts under a hashtag are the same story: Douyin refuses both to a guest, and no signed-in answer has been measured yet, so neither is offered there. On TikTok the account search answers a guest, while the post search refuses one outright (measured 2026-11-02), so an imported login is what it takes. Importing your own logged-in cookies widens what the rest can see, too. On Bilibili that matters most for comments: a guest is shown the three hottest and no more, so an imported login is what turns that into the full thread. On Douyin it decides an author's liked posts outright: a guest is shown none, public or not, so that list needs a logged-in identity in the pool. An imported login is used at your own risk: platforms rarely ban an account for reading data with it, but a ban cannot be ruled out (what to know before importing one).
The dashes are not gaps: a Douyin or TikTok post is never more than one video, so it has no parts to list, and a Bilibili live room has one number for good rather than an id per broadcast.
Media downloads, the content archive, counter snapshots, collections and a watchlist are built in; none of them needs another service.
Point Claude Code, Claude Desktop, Codex CLI, Cherry Studio or any other MCP client at /mcp on
your own instance, and the agent can read posts, authors and comments, store a post's media and
transcribe it. It goes through the same service layer, identity pool and scheduler as the REST API,
and an API key's scopes bound what it may do.
claude mcp add --transport http dtk http://127.0.0.1:8000/mcp/ \
--header "Authorization: Bearer dtk_YOUR_API_KEY"| Tool | What it does |
|---|---|
parse_url |
Fetch whatever a link points at โ a post, an author, a short link, pasted share text |
get_video ยท get_user |
One post, or one author profile, by id |
list_user_posts ยท list_comments |
An author's posts or a post's comments, a page at a time |
get_content_history |
The recorded counter history of a post or an author, from the local database |
pool_status |
Identity-pool and endpoint health, so an agent can tell "try later" from "broken" |
download_media |
Store a post's media on this instance |
transcribe_video |
Turn a stored video into text |
get_task_result |
Collect a result that did not finish within the call |
Ten tools, and few on purpose: every extra tool makes an agent worse at picking the right one, so a
new capability arrives as an argument to an existing tool. Setup for each client, and what every
tool returns: MCP and AI agents. The console shows the same guide at
/mcp-guide.
A downloaded video can be transcribed where it is stored. FunASR models โ Paraformer for the speech, FSMN-VAD to find where someone is talking, CT-Transformer for punctuation โ run in a sidecar on a network with no route out, so the audio never leaves the host and no API is called.
- Where: the Transcriptions page in the console, a Transcribe video button on every
finished download, the Library (one stored post, or a whole selection at once),
POST /api/v1/transcriptions, or thetranscribe_videoMCP tool - What you get: one whole text per video, with numbers written as digits, exportable as
.txt - How fast: a 3 min 13 s clip took 3.7 seconds on two CPU cores; no GPU needed
- What it is good at: Mandarin. The models are the general Chinese ones, so other languages come out poorly
It is off by default. The guided installer asks, then downloads the ~500 MB of models and checks each file against its SHA-256; by hand, see Preparing the FunASR ONNX models and Turning a stored video into text.
Paste whatever you have โ a short link, a post URL, or the whole caption a platform app puts on your clipboard:
https://v.douyin.com/L4NpDJ6/
https://www.douyin.com/video/7126745726494821640
https://www.douyin.com/jingxuan?modal_id=7660875690212492466
https://www.tiktok.com/@evil0ctal/video/7156033831819037994
https://www.tiktok.com/t/ZTR9nkkmL/
2.84 nqe:/ <caption> https://v.douyin.com/L4FJNR3/ <sentence telling you to open the app>
https://www.bilibili.com/video/BV1xx411c7mD
https://www.bilibili.com/video/av170001
https://b23.tv/<code>
https://space.bilibili.com/2
Short links are followed and a link buried in a caption is extracted. A post id is also checked against the platform's own encoding first, so an id that cannot exist is refused here rather than costing an upstream request. A Bilibili av number is turned into the bvid it stands for, so either spelling reaches the same post.
| Service | Python 3.12 ยท FastAPI ยท SQLAlchemy 2.0 (async) ยท Alembic ยท Typer ยท structlog |
| Transport | wreq (browser TLS fingerprint emulation) ยท httpx |
| Data | PostgreSQL + TimescaleDB ยท Redis |
| Console | React 19 ยท TypeScript ยท Vite ยท TanStack Query ยท wouter ยท i18next |
| Signing | a_bogus, X-Bogus, X-Gnarly, X-Dynosaur and Bilibili's WBI in pure Python |
| Identity minting | CloakBrowser, headless, in a container of its own, called over HTTP; Bilibili guests over plain HTTP, no browser |
| Downloader | Go 1.23, standard library only, statically linked into a scratch image |
| Transcription | FunASR ONNX (Paraformer, FSMN-VAD, CT-Transformer), offline, in a container with no network route |
| Auth | argon2id password hashing ยท API keys with scopes |
| Protocols | REST (OpenAPI) ยท MCP (streamable-http) ยท CLI |
| Tooling | uv ยท ruff ยท mypy ยท pytest ยท Docker Compose |
Nothing beyond Postgres and Redis is required. No Kafka, no Elasticsearch, no object store, no Kubernetes.
CloakBrowser is pinned to a specific commit. That pin is a security control โ see docker/Dockerfile.browser.
First, what dtk is. Douyin_TikTok_Download_API is a mouthful, so the code
says DTK instead: Douyin + TiKTok. The two platforms, and not the
download or API halves of the name.
It is the Python package (src/dtk/), the command (dtk --help), the prefix on
every environment variable (DTK_SECRET_KEY and friends), the Compose project
name (-p dtk), and the three letters in the console's title bar. Where you see
dtk, it means Douyin_TikTok_Download_API.
Douyin_TikTok_Download_API/
โโโ src/dtk/ the service; all of it lives here
โ โโโ api/ FastAPI routes, auth, OpenAPI localisation
โ โโโ platforms/ Douyin, TikTok and Bilibili adapters: endpoints, params, parsers
โ โโโ signing/ a_bogus / X-Bogus / X-Gnarly / X-Dynosaur / WBI
โ โโโ transport/ outbound requests, response classification
โ โโโ identity/ identity minting and health
โ โโโ scheduler/ identity selection, token buckets, circuit breakers
โ โโโ services/ the business layer, shared by REST, MCP and the CLI
โ โโโ worker/ async tasks, callbacks, scheduled collection
โ โโโ db/ SQLAlchemy models and Alembic migrations
โ โโโ ops/ diagnostics, backups, health checks, alerting
โ โโโ media/ downloader client
โ โโโ models/ one content model across every platform
โ โโโ urls/ link recognition, short-link expansion, id validation
โ โโโ mcp/ MCP server
โ โโโ cli/ the dtk command line
โ โโโ i18n/ server-side English and Chinese strings
โ โโโ core/ settings, logging, error types
โโโ web/ the React console, built into the app image
โ โโโ src/
โ โโโ pages/ one file per console page
โ โโโ components/ design system and shared components
โ โโโ locales/ console English and Chinese strings
โโโ docker/ four Dockerfiles, compose, and three sidecars
โ โโโ browser_rpc/ Python, wrapping CloakBrowser
โ โโโ downloader/ Go, the media download sidecar
โ โโโ transcriber/ Python, offline FunASR transcription
โ โโโ compose.yml
โโโ documents/ user documentation, 18 pages in each language
โโโ tests/ unit / integration / contract / replay
โโโ scripts/ smoke.sh
โโโ .github/workflows/ CI and Docker image publishing
โโโ alembic.ini
โโโ pyproject.toml
โโโ Makefile
If you would rather not think about it, the guided script asks a few questions and brings the stack up โ it works out your distribution, checks for Docker, and scales the resource limits to the machine:
curl -fsSL https://raw.githubusercontent.com/Evil0ctal/Douyin_TikTok_Download_API/main/install/install.sh -o install.sh
less install.sh # reading it first is a good habit
bash install.shAfterwards the same script is the operations tool. Run it again and it finds the install and opens a menu: status, upgrade (compared against the latest GitHub release), passwords, an extra administrator, backup and restore, runtime settings, disk cleanup, stop or uninstall. --manage goes straight there.
Details in install/README.md. The manual route follows.
There are two ways to install this; below is the recommended one. For the by-hand route, see Without Docker.
| How | Who for | Full steps |
|---|---|---|
| Docker Compose (recommended) | Almost everyone, production included | Installation ยท First install |
| By hand | Docker is not an option, or you are changing the code | For development ยท On bare metal |
Installing from mainland China? Switch your mirrors before you start, or the pull will most likely time out: Network preparation in mainland China.
You need Docker and Docker Compose. Start by cloning the repository โ the compose file, the Dockerfiles and the migrations all live in it, and the default branch is v5:
git clone https://github.com/Evil0ctal/Douyin_TikTok_Download_API.git
cd Douyin_TikTok_Download_APINothing in the repository ships a default password or key, so write .env next:
POSTGRES_PASSWORD=$(openssl rand -hex 24)
REDIS_PASSWORD=$(openssl rand -hex 24)
cat > .env <<EOF
DTK_SECRET_KEY=$(openssl rand -base64 48)
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
REDIS_PASSWORD=${REDIS_PASSWORD}
DTK_DATABASE_URL=postgresql+asyncpg://dtk:${POSTGRES_PASSWORD}@postgres:5432/dtk
DTK_REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0
EOFdocker compose -p dtk -f docker/compose.yml up -d
docker compose -p dtk -f docker/compose.yml logs api # prints the setup tokenOpen http://127.0.0.1:8000 and use the token from the log to create the first administrator.
That starts no browser container, and without it (--profile browser, see
the optional profiles) Douyin and
TikTok identities can only be imported, not minted: both hand a visitor its cookies from inside
their page scripts. Bilibili guests are minted over plain HTTP either way.