# 400 bad request with trying to get user id or follower list

**URL:** <https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046>\
**Category:** API\
**Created:** [March 27, 2021, 3:18pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046 "2021-03-27T15:18:08Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hevvee18](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/hevvee18/32/11770_2.png) [@Hevvee18](https://discuss.dev.twitch.com/u/Hevvee18)\
**Post date:** [March 27, 2021, 3:18pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/1 "2021-03-27T15:18:08Z")

</div>

keep getting 400 bad request error when trying to query for user’s follower list.  
am using bash to call the api.  
able to get token and pass token - just when it does a get for xyz url for follower list - return is 400 bad request or 301 permanently moved.  
can some explain to me why im getting the error or maybe help me debug what is happening?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [March 27, 2021, 3:26pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/2 "2021-03-27T15:26:31Z")

</div>

Please provide an example of the call you are making (with the token censored)

---

<div class="post-metadata">

**Author:** ![Hevvee18](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/hevvee18/32/11770_2.png) [@Hevvee18](https://discuss.dev.twitch.com/u/Hevvee18)\
**Post date:** [March 27, 2021, 3:31pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/3 "2021-03-27T15:31:15Z")

</div>

#!/bin/bash

# Ask for username and password

echo "What’s the username: "  
read name

# Curl for token

curl -X POST ‘[https://id.twitch.tv/oauth2/token?client\_id=](https://id.twitch.tv/oauth2/token?client_id=)\<client\_id\>&client\_secret=\<client\_code\>&grant\_type=client\_credentials&scope=user:read:email’ \>\> token.txt && awk -F ‘"’ ‘{print $4}’ token.txt \>\> token\_only.txt  
token=$(cat token\_only.txt)

# Get User ID

curl -H ‘Accept: application/vnd.twitchtv.v5+json’ -H ‘Client-ID: \<client\_id\>’ -H ‘Authorization: Bearer \<client\_code\>’ -H 'Authorization: OAuth '$token '[https://api.twitch.tv/kraken/user?login=’$name](https://api.twitch.tv/kraken/user?login='%24name) -v

curl -H ‘Accept: application/vnd.twitchtv.v5+json’ -H ‘Client-ID: \<client\_id\>’ -H ‘Authorization: Bearer \<client\_code\>’ -H 'Authorization: OAuth '$token -X GET [https://api.twitch.tv/helix/streams?user\_login=$name](https://api.twitch.tv/helix/streams?user_login=%24name) -v

# Remove Token for next go

rm token\*

im almost positive there is something wrong with the url that im trying to call

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [March 27, 2021, 3:33pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/4 "2021-03-27T15:33:53Z")

</div>

> curl -H ‘Accept: application/vnd.twitchtv.v5+json’ -H ‘Client-ID: xuvnniaiv7jupqbb4wdfo2rbbhlefv’ -H ‘Authorization: Bearer \<client\_code\>’ -H 'Authorization: OAuth '$token

Should be just

> curl -H ‘Client-ID: xuvnniaiv7jupqbb4wdfo2rbbhlefv’ -H ‘Authorization: Bearer \<client\_code\>’

You are sending both Kraken and Helix headers. for all requests. Shouldn’t be a problem but we can clean our your headers to JUST Helix headers

> [@Hevvee18](#):
>
> # Get User ID
> 
> curl -H ‘Accept: application/vnd.twitchtv.v5+json’ -H ‘Client-ID: xuvnniaiv7jupqbb4wdfo2rbbhlefv’ -H ‘Authorization: Bearer \<client\_code\>’ -H 'Authorization: OAuth '$token '[https://api.twitch.tv/kraken/user?login=’$name](https://api.twitch.tv/kraken/user?login='%24name) -v

use helix get users

> **[Reference](https://dev.twitch.tv/docs/api/reference/)**
>
> Twitch Developer tools and services to integrate Twitch into your development or create interactive experience on twitch.tv.

There is no follow request in your code.

---

<div class="post-metadata">

**Author:** ![Hevvee18](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/hevvee18/32/11770_2.png) [@Hevvee18](https://discuss.dev.twitch.com/u/Hevvee18)\
**Post date:** [March 27, 2021, 3:58pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/5 "2021-03-27T15:58:35Z")

</div>

So i have looked through all the different references and forms - any way i use it i still get a 400  
if i remove the oauth - i get a “missing oauth” error and if i add it back - you can see what i get below.

cleaned up code:

curl -X POST ‘[https://id.twitch.tv/oauth2/token?client\_id=’$client\_id’&client\_secret=’$client\_secret’&grant\_type=client\_credentials&scope=user:read:email](https://id.twitch.tv/oauth2/token?client_id='%24client_id'&client_secret='%24client_secret'&grant_type=client_credentials&scope=user:read:email)’ \>\> token.txt && awk -F ‘"’ ‘{print $4}’ token.txt \>\> token\_only.txt  
token=$(cat token\_only.txt)

# Get User ID

curl -H 'Client-ID: '$client\_id -H 'Authorization: Bearer '$client\_secret -H 'Authorization: OAuth '$token '[https://api.twitch.tv/helix/users?login=’$name](https://api.twitch.tv/helix/users?login='%24name) -v

# Remove Token for next go

rm token\*

this is what the curl is sending as get request to [api.twitch.tv](http://api.twitch.tv):  
GET /helix/users?login=$name HTTP/2

and getting this back:

 400 Bad Request
# 400 Bad Request
\* Connection #0 to host api.twitch.tv left intact

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [March 27, 2021, 4:03pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/6 "2021-03-27T16:03:17Z")

</div>

> [@Hevvee18](#):
>
> this is what the curl is sending as get request to [api.twitch.tv](http://api.twitch.tv):  
> GET /helix/users?login=$name HTTP/2
> 
> and getting this back:
> 
> 400 Bad Request

That would suggest you tried to lookup `$name`, which is not a valid username (Usernames can’t contain $)

You should of also got a body that desribes the error

```auto
{
"error": "Bad Request",
"status": 400,
"message": "Invalid login names, emails or IDs in request"
}

```

![image](https://d2opxh93rbxzdn.cloudfront.net/original/2X/4/43b20b7fd13ca782ff3fef8e940fc351e3ffbc0c.png)

---

<div class="post-metadata">

**Author:** ![Hevvee18](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/hevvee18/32/11770_2.png) [@Hevvee18](https://discuss.dev.twitch.com/u/Hevvee18)\
**Post date:** [March 27, 2021, 4:04pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/7 "2021-03-27T16:04:56Z")

</div>

i was hiding the user name that it was using - if you want to retry its mine personal username hevvee18  
below is the entire output from everything

What’s the username:  
hevvee18  
% Total % Received % Xferd Average Speed Time Time Time Current  
Dload Upload Total Spent Left Speed  
100 121 100 121 0 0 180 0 --:–:-- --:–:-- --:–:-- 179

- Trying 151.101.206.214:443…
- Connected to [api.twitch.tv](http://api.twitch.tv) (151.101.206.214) port 443 (#0)
- ALPN, offering h2
- ALPN, offering http/1.1
- successfully set certificate verify locations:
- CAfile: /etc/ssl/certs/ca-certificates.crt
- CApath: /etc/ssl/certs
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- TLSv1.3 (IN), TLS handshake, Server hello (2):
- TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
- TLSv1.3 (IN), TLS handshake, Certificate (11):
- TLSv1.3 (IN), TLS handshake, CERT verify (15):
- TLSv1.3 (IN), TLS handshake, Finished (20):
- TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
- TLSv1.3 (OUT), TLS handshake, Finished (20):
- SSL connection using TLSv1.3 / TLS\_AES\_256\_GCM\_SHA384
- ALPN, server accepted to use h2
- Server certificate:
- subject: C=US; ST=California; L=San Francisco; O=Fastly, Inc.; [CN=twitch.map.fastly.net](http://CN=twitch.map.fastly.net)
- start date: Mar 26 21:41:40 2021 GMT
- expire date: Mar 27 21:41:40 2022 GMT
- subjectAltName: host “[api.twitch.tv](http://api.twitch.tv)” matched cert’s “\*.twitch.tv”
- issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign CloudSSL CA - SHA256 - G3
- SSL certificate verify ok.
- Using HTTP2, server supports multi-use
- Connection state changed (HTTP/2 confirmed)
- Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
- Using Stream ID: 1 (easy handle 0x55fe25fe6dc0)

> GET /helix/users?login=hevvee18 HTTP/2  
> Host: [api.twitch.tv](http://api.twitch.tv)  
> user-agent: curl/7.74.0  
> accept: _/_  
> client-id: \<client\_id\>  
> authorization: Bearer \<client\_secret\>  
> authorization: OAuth

- TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
- Connection state changed (MAX\_CONCURRENT\_STREAMS == 100)!  
\< HTTP/2 400  
\< server: awselb/2.0  
\< content-type: text/html  
\< date: Sat, 27 Mar 2021 16:10:11 GMT  
\< x-served-by: cache-sea4458-SEA, cache-pdk17837-PDK  
\< x-cache: MISS, MISS  
\< x-cache-hits: 0, 0  
\< x-timer: S1616861411.495229,VS0,VS0,VE64  
\< strict-transport-security: max-age=300  
\< content-length: 122  
\<  
\<  
\<400 Bad Request  
\<  
\<
# 400 Bad Request
  
\<

\<\* Connection #0 to host api.twitch.tv left intact

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [March 27, 2021, 4:13pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/8 "2021-03-27T16:13:23Z")

</div>

Then I don’t know what wrong

as you wrote

> [@Hevvee18](#):
>
> this is what the curl is sending as get request to [api.twitch.tv](http://api.twitch.tv):  
> GET /helix/users?login=$name HTTP/2

I assumed that was what you actually sent/got back

> [@Hevvee18](#):
>
> # Get User ID
> 
> curl -H 'Client-ID: '$client\_id -H 'Authorization: Bearer '$client\_secret -H 'Authorization: OAuth '$token '[https://api.twitch.tv/helix/users?login=’$name](https://api.twitch.tv/helix/users?login='%24name) -v

You are trying to send your client secret as your auth header  
And you are _still_ sending a Kraken auth header.  
Which is winning.

> curl -H 'Client-ID: '$client\_id -H 'Authorization: Bearer '$client\_secret -H 'Authorization: OAuth '$token '[https://api.twitch.tv/helix/users?login=’$name](https://api.twitch.tv/helix/users?login=%27%24name) -v

Should be

> curl -H 'Client-ID: '$client\_id -H 'Authorization: Bearer '$token '[https://api.twitch.tv/helix/users?login=’$name](https://api.twitch.tv/helix/users?login=%27%24name) -v

as per the example call

```auto
curl -X GET 'https://api.twitch.tv/helix/users?id=141981764' \
-H 'Authorization: Bearer cfabdegwdoklmawdzdo98xt2fo512y' \
-H 'Client-Id: uo6dggojyb8d6soh92zknwmi5ej1q2'

```

---

<div class="post-metadata">

**Author:** ![Hevvee18](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/hevvee18/32/11770_2.png) [@Hevvee18](https://discuss.dev.twitch.com/u/Hevvee18)\
**Post date:** [March 27, 2021, 4:18pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/9 "2021-03-27T16:18:24Z")

</div>

ok so i get it now - it should be sending the token not the actually client\_secret

that fixed ended up being the solution.

thank you sir

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [April 26, 2021, 4:18pm UTC](https://discuss.dev.twitch.com/t/400-bad-request-with-trying-to-get-user-id-or-follower-list/31046/10 "2021-04-26T16:18:28Z")

</div>

Closed on April 26, 2021, 4:18pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.