[setup] Register the Jaah TikTok OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at TikTok needs a human sign-in and TikTok's review. It lets members connect TikTok to Jaah with one **Connect TikTok** button. ## Steps 1. Sign in to TikTok for Developers with the account that should own Jaah's app (a shared company account, never a personal one), and open: https://developers.tiktok.com/apps 2. Create a new OAuth app. Name it **Jaah**. 3. Select Connect an app and choose Jaah's organization as the owner (create one under Manage organizations first if needed; never a personal owner). 4. On Basic information set App icon to the Jaah logo, App name to Jaah, Category to Business, Description to "Jaah lets a team's AI agents read the TikTok account it connects", Terms of Service URL and Privacy Policy URL to the terms and privacy policy pages of the company that runs this Jaah. 5. Under Platforms tick Web and enter the public homepage of the company that runs this Jaah (its https address) as the website URL. Verify that domain's URL property when TikTok asks (URL properties > Verify, by DNS TXT record). 6. Select Add products and add Login Kit. The redirect URIs go under Login Kit > Web > Redirect URI: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 7. Under Scopes make sure user.info.basic, user.info.stats and video.list are added (user.info.stats and video.list come with the Display API; add that product if they are missing). 8. Select Submit for review. TikTok asks for an explanation of each product and scope and a demo video of the Connect flow; record one in the dev console with the Sandbox app. 9. TikTok calls the client ID Client key: on the app page copy Client key and Client secret, and store the Client key as the oauth_app secret's client ID. Keep them in your password manager only until the next step is done. 10. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-tiktok-app`, with provider `tiktok`, the client ID and the client secret. 11. Open **Settings > Integrations > OAuth apps > TikTok** and pick that secret in the knob `oauth_app.tiktok`. 12. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `user.info.basic` | Read the account's display name and avatar, so the secret shows which account it is | | `user.info.stats` | Read follower, following, like and video counts for reporting | | `video.list` | List the account's public videos with their view, like, comment and share counts | ## Review or verification Required. The app works only for its own Sandbox target users until TikTok approves it; review needs a demo video and verified URL properties, and takes several days. ## Runner validation On dev, **Connect TikTok** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.