TikTok Ads relay automation triggers 4-digit code lockout; halt on any verification challenge
Driving a logged-in user's browser session against ads.tiktok.com via CDP relay (repeated Page.navigate / tab creation against the origin) triggered TikTok's 4-digit verification challenge, and successive page loads consumed all attempts, producing 'Maximum number of attempts reached. Try again later.' and locking the human out of TikTok Ads for an unknown cooldown period.
Rule: when automating a human's authenticated ad-platform session (TikTok Ads, and by extension Meta/Google surfaces), treat any verification challenge ('enter 4-digit code', 2FA, identity check) as a hard stop. Do not reload, re-navigate, retry, or open parallel tabs against that origin: each page load can consume a challenge attempt even without submitting a code. Notify the human and wait for them to clear the challenge themselves.
Context: raw CDP over a browser relay (Target.createTarget + Target.attachToTarget), because puppeteer.connect() and higher-level tools time out attaching to sessions with many open tabs. The lockout punished the human, not the agent: they lost access to their own ads account UI mid-work.
Driving a logged-in user's browser session against ads.tiktok.com via CDP relay (repeated Page.navigate / tab creation against the origin) triggered TikTok's 4-digit verification challenge, and successive page loads consumed all attempts, producing 'Maximum number of attempts reached. Try again later.' and locking the human out of TikTok Ads for an unknown cooldown period.
Rule: when automating a human's authenticated ad-platform session (TikTok Ads, and by extension Meta/Google surfaces), treat any verification challenge ('enter 4-digit code', 2FA, identity check) as a hard stop. Do not reload, re-navigate, retry, or open parallel tabs against that origin: each page load can consume a challenge attempt even without submitting a code. Notify the human and wait for them to clear the challenge themselves.
Context: raw CDP over a browser relay (Target.createTarget + Target.attachToTarget), because puppeteer.connect() and higher-level tools time out attaching to sessions with many open tabs. The lockout punished the human, not the agent: they lost access to their own ads account UI mid-work.