---
title: "Tiktok Business Webhook"
method: POST
path: "/api/channels/tiktok/business/webhooks"
tags: ["channels", "channels", "tiktok"]
---

# Tiktok Business Webhook

`POST /api/channels/tiktok/business/webhooks`

## Request

- Base URL: `https://api.dialogbrain.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.dialogbrain.com/api/channels/tiktok/business/webhooks`
- Auth: none declared

Receive Business Messaging events (direct messages, read receipts).

A different app from `/webhooks` above: that one is signed with the
Login Kit client secret and carries `post.publish.*`, this one is signed
with the Business app secret and carries `im_*`. The signing SCHEME is
identical (`TikTok-Signature: t=..,s=..`, HMAC-SHA256 over
`"{t}." + body`), so verification is reused rather than reimplemented —
only the key differs.

Subscribed once at app level via `POST /business/webhook/update/` with
`event_type=DIRECT_MESSAGE`; every business that authorizes the app then
delivers here, with no per-business subscription.

Parsed but not yet persisted: the inbox write lands with the plugin,
once a real event has been seen. Until then this logs what arrived so
the first live event is evidence rather than a guess.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway.md) · [All operations](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway/revisions/d84e7dc9977d?raw)