How TikTok's X-Argus request signing works

Every request to TikTok's private mobile API carries an X-Argus header. Get it wrong and the server doesn't error, it returns HTTP 200 with a zero-length body. That silent failure is the single biggest time-sink when you start.

What's inside

Argus is a protobuf structure describing the request, the device, the app version, a hash of the query, a timestamp, then encrypted in two layers with the Simon and Speck block ciphers, with SM3 doing the hashing. The key material is per-app: the license id and sign key differ between TikTok, TikTok Lite and Douyin.

x-argus   ~752 chars   the sealed request descriptor
x-ladon   ~48 chars    xk · licenseID · appID, Speck-encrypted
x-gorgon  / x-khronos   the older, lighter pair

Why it's hard to fake

The signature binds to the exact query string and body, the device identity, and a timestamp that has to be fresh. You can't lift one from a captured request and reuse it, change any parameter and it's invalid. That's the whole point.

The full walk-through, device registration, activation, and the cipher internals, is in Scraping TikTok's Mobile API.