Verification, and what is read

You are given a short code, you add it to your bio, and the system reads your public profile and finds it. Once verified you remove it. Only the person who can edit that bio can pass the check, which is exactly what ownership means.

It is deliberately low-tech. A password would be a liability for both sides, and an official login would grant far broader access than reading a public profile requires.

The Instagram side proves ownership differently — by having you leave five real comments through the app — because Instagram bios are read less reliably. Both routes prove the same thing without a credential.

Public profile fields: username, follower and following counts, video count, total likes, whether the account is private or verified, and your duet, stitch and comment settings.

Public video data for recent posts: the video id, when it was posted, the caption, its hashtags, the sound, and the duration.

Public counters for those videos: plays, likes, comments, shares and saves.

Nothing private. No analytics only you can see, no messages, no drafts, no audience demographics. Everything read is visible to anyone who opens your profile.

Delivery is confirmed by a combination of automated checks and pattern review across an account's history, rather than by any single test. Nothing here is described as verified unless it is.

The creator who was expecting an engagement can dispute it. Disputes carry screenshot proof, a right of reply and a human moderator, and the penalties run both ways — filing a false report costs the same as failing to deliver, so neither side of the lie is free.

On top of that sit the pacing and realism rails: an account whose actions arrive too fast, too evenly, or in a mix real audiences never produce is visible as a pattern long before any individual action is examined.

What is not published is a breakdown of which checks apply to which action. A public map of where the checks are thinnest is of use to almost nobody except the people the checks exist to stop.

Two separate things stand in the way, and either alone would be enough.

The first is a feature flag. The whole TikTok surface — the exchanges, both PowerSwaps, the groups hub and account connection — sits behind features.tiktok, set by the TIKTOK_ENABLED environment variable and false unless someone deliberately turns it on. Anyone who is not an admin gets a 404, not a 403: hidden should be indistinguishable from absent, and a 403 confirms there is something there.

The second is data. The service that reads public TikTok profiles has no provider configured, so it returns nothing. Verification cannot complete, which means no TikTok account exists in the system, which means every room is empty as well as closed.

Neither of these is a policy decision dressed up as a technical one. The code is written, tested and running; it is switched off and it has nothing to read from.