Verification, and what is read

You are given a short code, you add it to your bio, and the system reads your public profile and finds it. Once verified you remove it. Only the person who can edit that bio can pass the check, which is exactly what ownership means.

It is deliberately low-tech. A password would be a liability for both sides, and an official login would grant far broader access than reading a public profile requires.

The Instagram side proves ownership differently — by having you leave five real comments through the app — because Instagram bios are read less reliably. Both routes prove the same thing without a credential.

Public profile fields: username, follower and following counts, video count, total likes, whether the account is private or verified, and your duet, stitch and comment settings.

Public video data for recent posts: the video id, when it was posted, the caption, its hashtags, the sound, and the duration.

Public counters for those videos: plays, likes, comments, shares and saves.

Nothing private. No analytics only you can see, no messages, no drafts, no audience demographics. Everything read is visible to anyone who opens your profile.

Comments can. They are visible on the video, so the system can confirm one arrived rather than take a member's word for it.

Watches, saves and profile visits cannot. TikTok exposes no third-party signal for any of them, and no service can verify them. Anyone claiming to is guessing.

This is stated plainly rather than buried, because the alternative is implying a verification that does not exist. Three of the four actions run on the honour system, backed by pattern review rather than by proof.

Two separate things stand in the way, and either alone would be enough.

The first is a feature flag. The whole TikTok surface — the exchanges, both PowerSwaps, the groups hub and account connection — sits behind features.tiktok, set by the TIKTOK_ENABLED environment variable and false unless someone deliberately turns it on. Anyone who is not an admin gets a 404, not a 403: hidden should be indistinguishable from absent, and a 403 confirms there is something there.

The second is data. The service that reads public TikTok profiles has no provider configured, so it returns nothing. Verification cannot complete, which means no TikTok account exists in the system, which means every room is empty as well as closed.

Neither of these is a policy decision dressed up as a technical one. The code is written, tested and running; it is switched off and it has nothing to read from.