TikTok One for agencies: creator access without logins

An agency working with TikTok creators does not need their logins. TikTok One, which absorbed the Creator Marketplace, is where a brand or its agency finds creators, invites them to a campaign and reviews their videos. When a video is approved for ads, it goes to TikTok Ads Manager as a Spark Ad, run from the advertiser's own ad account under the creator's handle. The creator grants that use of the post. Nobody sends a password.

That matters because the password was the riskiest thing an agency used to hold. A creator's account is their income, and an agency that signs in to it from its own office, on its own network, is a common cause of the login checks and lockouts that land on that account.

TikTok's business tools are built for brands and agencies running campaigns from their own accounts. Mosaic keeps accounts you are entitled to run apart; it does not change what TikTok allows.

What the TikTok creator marketplace gives an agency now

Inside TikTok One, an agency working for a brand can search creators by region and audience, shortlist them, send an invitation to a campaign, receive the creator's draft video for review and approve it. The brief and the review live in that campaign instead of in DMs.

The step that replaces the login comes after approval. When the creator agrees that a post can be used in ads, the agency syncs it to Ads Manager, where it becomes a Spark Ad: the ad shows the creator's handle, links to the creator's profile and counts its engagement on the creator's original post. The budget, targeting and schedule belong to the advertiser's ad account, the same as for any other ad.

How it works: Logins and 2FA codes

Three ways a creator can authorise a post

TikTok One campaigns are one route. Two others work without a TikTok One campaign at all, and agencies use both.

The first is a code for one post. The creator opens the post in the TikTok app, goes to its ad settings, turns on ad authorisation, picks how long it should last and copies the code. The agency pastes it into Ads Manager and the post appears as an authorised Spark Ads post for the length of time the creator chose. The creator can cancel it from the app.

The second is account-level access through Business Center. A Business Center admin starts a request for access to a TikTok account, the account owner approves it, and the Business Center's members and partners can then use that account's posts for Spark Ads. That access is not tied to a code with an end date; it lasts until the account owner or an admin cancels it. It suits a brand's own TikTok account, or a creator on a long contract, better than a one-off code.

All three end the same way: permission over content, granted by the person who owns the account, on their own phone.

Why the creator's login was the risk

The usual reason an agency held a creator's login was to put that creator's post behind a budget, or to post on their behalf. The habit cost both sides.

For the creator, a sign-in from a new device in a different city looks like a takeover, and TikTok treats it like one, with verification prompts and sometimes a lock. If two people at the agency sign in from two places, the account collects more of those events. The creator also loses control: anyone with the password can post, delete or change the email.

For the agency, a password is a liability with no upside. It has to be stored somewhere, shared with whoever runs the account that week, and taken back when the contract ends, which in practice means asking the creator to change it. Every one of those steps is a place for it to leak. A Spark Ads code, by contrast, can be pasted into a ticket without much harm: it authorises one post for ads and nothing else.

Instagram moved the same way with partnership ads; the brand-side steps are in partnership ads let a brand run a creator's post without the password.

What the agency's browser holds instead

Once the creators' passwords are gone, the agency's logins are its own: its TikTok for Business account, its Business Center, and the client brands' Business Centers it works in as a partner. That is a shorter list, and each entry belongs to a business that agreed to it.

It is still more than one login per person, and that is where we keep each client's work in its own Mosaic profile. A profile per client brand has its own cookies, so signing in to one Business Center never leaves a session sitting in another, and its own proxy exit and fingerprint, so the client's account sees the same browser each time. The companion inside the profile keeps that client's 2FA codes, so nobody on the team has to forward a code from their phone. How many ad accounts one Business Center may create is a separate rule, covered in how TikTok decides your Business Center ad account limit, and what TikTok says about one person running several accounts is in what TikTok's guidelines say about running several accounts.

The setup for a whole social team, with a named window per brand, is on Mosaic for social media managers running brand accounts.