401 troubles with Create Extension Secret endpoint

API
1

Hello again developers,

I am having some trouble getting the Create Extension Secret endpoint to return a 200. I am using an unexpired JWT signed (HS256) with the extension’s secret (not the client secret) as the Authorization Bearer token. Here is the payload of that JWT:

{
  "exp": 1785454675,
  "user_id": "1101868592",
  "role": "external"
}

Here is the HTTP request/response (response headers removed for brevity):

{
    "request": {
        "url": https://api.twitch.tv/helix/extensions/jwt/secrets?extension_id=ox7nw9klrf7x3rz4lqqo3y4sexh9xd,
        "method": POST,
        "headers": {"Client-Id":["ox7nw9klrf7x3rz4lqqo3y4sexh9xd"],"Authorization":["REDACTED"]}
    },
    "response": {
        "status": Unauthorized,
        "content": {"error":"Unauthorized","status":401,"message":"Error (401): Authorization refused"}
    }
}

Interestingly, using the same JWT, I am able to get a 200 response from other extension endpoints, such as Get Extension Secrets. Some other behaviors I observed when testing:

  • Using an app access token or invalid JWT as the authorization results in a 401 with a slightly different error message (“authentication failed”).
  • Using “Extension” instead of “Bearer” (as indicated in docs) in the Authorization header results in a 401 asking to include a JWT.
  • Setting the “delay” query parameter does not change the outcome.

I’ve been monkeying around in curl for quite a bit trying to debug this one, so I figured I’d ask. Probably just some boneheaded mistake I’m making with the JWT or extension config. This is for an unreleased extension I’m just using to test a library against the API.

2

Just for completeness:

As JWT is required not app access token

Thats for using helixToken from the front end.

And these endpoints require the user of a back end created token. Hence the 401. (The linked page is " Extension Front End")

The TLDR:

I tested on a unreleased and a released extension and got the same.

I suspect it’s faulty, I have filed a report Create Extension Secret - 401: Authorization refused · Issue #1190 · twitchdev/issues · GitHub

3

Thanks, Barry. I really appreciate you looking into this.