Whitelisting is not a Spark code
Whitelisting authorizes a handle. A Spark code authorizes one post for a window. Neither is a usage licence for the MP4.
Whitelisting authorizes a handle. A Spark code authorizes one post for a time window. They are not the same token. A creator who pasted a code into Slack did not give you their account. A brand that "whitelisted" a TikTok without a code does not have Spark. Neither grant is a usage rights licence for the MP4.
This page is the token-versus-handle split. The mechanism walkthrough of TikTok codes and Meta Partnership Ads is a different post. The three-grant UGC contract (file, Spark, whitelist) is a different post. Here the only job is to stop treating a code as if it were a handle, and a handle as if it were a code.
A Spark code is one video, one window
TikTok issues authorization as a code scoped to one video. The creator opens that post, turns on ad authorization, and generates a token. Five videos means five codes. The creator also picks the window — TikTok offers 7, 30, 60, or 365 days — and when the window ends, spend on that post stops until they issue a new code.
What the code actually is:
- Permission to run Spark Ads against that live post.
- A clock. Not a vibe. Not "until the campaign feels done."
- Identity and comments remaining on the original post. The paid unit is that post with a budget.
What the code is not:
- Access to the creator's other videos.
- Access to Instagram, YouTube, or a second TikTok they have not authorized.
- Permission to recut, recaption, or generate a cousin and still call it Spark.
- A password. If someone sent a password, that is the old informal whitelist, and it is how accounts get wrecked.
Write the SOW to match the tool. "Spark for 12 months" is not a clause if the code will expire in 60 days. Name the post, or "posts we jointly approve, listed in an annex." Name the window the creator will actually generate. Name the cost of a new code when creative fatigue hits. Renewal is a task.
A code also requires a post. A UGC creator who only delivers a file cannot generate a Spark code. There is nothing to authorize. Buy paid use of the file and run it from the brand account — that is not Spark, and it should not be billed as Spark.
Whitelisting is the handle
Whitelisting, in the media sense, is a brand running paid ads through a creator's identity with permission. Meta's current product is Partnership Ads: scoped access, no password (facebook.com/business/help/442108830566254). The ad can show the creator, both accounts, or a dynamic header. Budget and targeting sit in the brand's ad account. The identity in the unit is what you bought.
TikTok's closest product is Spark, and Spark is post by post, not account-wide. Calling a Spark code "the whitelist" is how a brand later asks for "the rest of their TikToks" and discovers there is no rest. There are only more codes.
What a handle grant has to name:
- Platform. Instagram is not TikTok. Partnership Ads are not Spark.
- The handle.
- Per post or account-scoped, matching what that platform actually offers.
- Term. Take-down. What happens to live ads when permission dies.
- Whether the brand may run cuts the creator did not publish organically.
What a handle grant is not:
- A Spark code. Different platform furniture, different scope.
- A usage licence for an MP4 you will run as a brand dark post. The identity in the header is the point of whitelist. Strip the identity and you bought the wrong object.
- Informal login sharing. Use the platform's permission product.
The glossary is blunt: usage rights and ad-authorization are different permissions on every major platform. Using a content licence to justify running ads through the creator's account is the most common way these arrangements go wrong. Using a Spark code to justify handle-level control is the TikTok version of the same mistake.
The code is not the handle, and neither is the file
Three objects, three invoices, three ways to steal the wrong one.
You have a code and you run a different cut. Spark's creative is the authorized post. A new hook means a new post and a new code, or a usage licence to run a different file from the brand account as a non-Spark ad. The code does not stretch to the recut.
You have a Partnership Ads permission and you treat it as a Spark code. Meta is not TikTok. The header identity, the tagging step, and the Ads Manager object are different. A creator who partnered on one IG post did not authorize a TikTok. Collect the TikTok code separately, or do not run TikTok as if you had.
You have a file licence and you tell the ads manager it is whitelisted. The ad shows the brand. Comments land on a brand unit or a dark post. That can be the right buy. It is not whitelist. Do not report it as creator-identity media. 92% of consumers trust a peer over a brand message (Kapwing 2026; Billo). You either bought that peer in the header or you did not.
AI UGC cannot produce a Spark code. A synthetic person has no TikTok to authorize. A digital twin is a likeness file. A code is an identity on a platform. Do not enroll a twin and then ask the creator for "the Spark on the twin." There is no such object.
66% of creators offer UGC services and the creator population grew 93% year on year (Kapwing 2026; creator.co). File-only creators often will not generate codes. Handle-owners often will not sell a perpetual file buyout. Buy the token you can actually collect.
Collect the token the brief named
If the brief is Spark, the checklist is short. The post is live. The code is in the ads account. The window is on a calendar with a renewal date before expiry, not after. Comment moderation is assigned to the original post. The next opening is already cut so a new post can be authorized when this one fatigues.
If the brief is whitelist on Meta, the checklist is different. The partnership tag exists. Permission is scoped. Header identity is chosen on purpose, not left on default because nobody looked. The term is in the SOW. Nobody has the password.
The file, if you also need it, is a third checklist: channels, paid use, duration, whether a generate off their face is allowed. The UGC video generator can make variants you are allowed to make. It cannot mint a Spark code. Article 50 still wants a perceivable label on authentic-looking synthetic people for EU audiences from 2 August 2026. A code on a human post does not create that duty. A generated stand-in does.
Keep the nouns in the brief. Code. Handle. File. Sign up if the week is producing the cuts that will need one of those three grants — and write which grant before anyone films.
FAQ
Does one Spark code cover the creator's whole TikTok?
No. The code is per video. Five posts need five codes, each with its own window. Account-wide language in a SOW does not change what TikTok will issue.
If I have Partnership Ads, do I still need a Spark code?
Yes, if you want TikTok Spark. Partnership Ads are Meta. A Spark code is TikTok. A creator who granted one platform did not grant the other. Collect both or run one.
Can I use a Spark code to run a recut as a dark post?
No. The code authorizes that live post as Spark. A recut on an unpublished brand unit is paid use of a file, which is a usage licence. Without that licence, you do not have the recut.