What you can post
TikTok publishing is video only, one video per post, via the Content Posting API Direct Post flow. Dravo pulls the video from a public URL and submits it with a title and privacy settings.
Scope
Dravo requests video.publish (Direct Post, publishes to the profile) plus
user.info.basic for identity. video.publish is the right scope for direct
posting; video.upload (drafts in the inbox) is a different flow and not what
Dravo uses.
Privacy and audit
While your TikTok app is unaudited it runs in development mode, where posts are
forced to SELF_ONLY (private, visible only to the creator). Dravo defaults the
privacy level to SELF_ONLY to match this. To post publicly you must pass
TikTok's app audit, which can take a few weeks. You can override the privacy
level (once audited) via provider_options.tiktok.privacy_level.
Domain verification
The Direct Post pull flow requires the video URL's domain to be verified in your TikTok developer settings, or it returns a URL ownership error. The simplest fix is to ingest the video into Dravo storage and publish the returned URL.