Full Answer

The credential setup takes approximately five minutes but requires the correct account permissions. You must be an Admin or Operator on the TikTok Ads account to generate Events API access tokens. Analyst-level access can view pixels but cannot create or manage API credentials.

The access token is a long-lived credential that does not expire automatically. TikTok does not enforce rotation, but security best practice is rotating annually or immediately after any team member with access leaves the organization. If compromised, an attacker could send fraudulent conversion events to your TikTok pixel, corrupting your ad optimization data.

The Pixel Code is a numeric identifier assigned when you create a Web Pixel in TikTok Ads Manager. Each ad account can have multiple pixels, and each pixel has its own code. When implementing Events API, ensure the pixel code matches the same pixel your browser-side TikTok Pixel uses — otherwise deduplication between browser and server events will not function.

For WooCommerce implementations, store both credentials as WordPress options or environment variables accessible to your server-side code. Never expose the access token in JavaScript, HTML source, or any code that reaches the browser. The token authenticates server-to-server communication and should exist only in your server environment. WordPress plugins that support TikTok Events API provide admin fields for entering these credentials and store them in the WordPress options table with appropriate access controls.