Scrapping TikTok with mobile API (search with filters)

-H 'X-Argus: DwxHKQeBPWvG....19M/ig=' \
-H 'X-Gorgon: 8404b05e5000...6372af' \

The TikTok API uses several security headers for request verification and encryption:

[LIST=1]
[*]X-Gorgon: A 84-bit encryption mechanism that helps verify legitimate requests. It's generated using device information, URL parameters, and other request data.
[*]X-Khronos: A timestamp value (not an encryption) used to prevent replay attacks by ensuring requests are processed within a valid time window.
[*]X-Argus: A 164-bit encryption mechanism that evolved from X-Gorgon with more robust security. It incorporates additional parameters and provides stronger protection against unauthorized API access.
[/LIST]
These encryption methods are part of TikTok's API security layer to prevent unauthorized access and scraping. The specific implementation details may have evolved since my knowledge cutoff in October 2024, so there could be updates to the bit lengths or encryption approaches.

Retry
L
are they broken?
Edit

As of my last knowledge update in October 2024, TikTok's security headers (X-Gorgon, X-Argus, and X-Khronos) had not been definitively "broken" in the sense of being completely compromised, but they had been reverse-engineered to some extent by developers.

Various third-party libraries and tools claimed to generate these security tokens, allowing unofficial access to TikTok's API. This suggests that while the encryption mechanisms weren't completely secure against determined analysis, they still presented barriers to casual API access.

TikTok regularly updates these security mechanisms to counter reverse engineering efforts. They employ obfuscation techniques and frequently change implementation details, making it an ongoing cat-and-mouse game between TikTok's security team and those attempting to bypass their API protections.

Without more recent information, I can't comment on their current state, but it's likely that TikTok has continued to evolve these security measures while third parties have continued their efforts to bypass them.

Retry
L
many people claiming on github they can sell it via Telegram, is it scam?
Edit

Claims of selling TikTok API security tokens (X-Gorgon, X-Argus, X-Khronos) via Telegram should be treated with significant skepticism. There are several reasons to be cautious:

[LIST=1]
[*]Many of these offers are likely scams where you pay but receive nothing of value or something that doesn't work properly.
[*]Even if someone does provide a working solution, TikTok regularly updates their security mechanisms, so any "solution" would likely have a short shelf life before becoming obsolete.
[*]Some offerings might be malware disguised as token generators, putting your system and data at risk.
[*]Using unofficial methods to access TikTok's API violates their Terms of Service and could result in account bans or potentially legal issues.
[*]Legitimate reverse-engineering efforts are typically shared openly in developer communities rather than sold through private channels.
[/LIST]
While some developers have genuinely reverse-engineered aspects of TikTok's security implementation for research purposes, commercial offerings through Telegram channels promising "permanent" solutions should raise red flags

        aweme_detail = traverse_obj(
            self._call_api('multi/aweme/detail', aweme_id, data=urlencode_postdata({
                'aweme_ids': f'[{aweme_id}]',
                'request_source': '0',
            }), headers={'X-Argus': ''}), ('aweme_details', 0, {dict}))