# App Access Token with Scopes? **URL:** \ **Category:** API\ **Created:** [April 19, 2024, 1:22pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286 "2024-04-19T13:22:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Atlas](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/atlas/32/29870_2.png) [@Atlas](https://discuss.dev.twitch.com/u/Atlas)\ **Post date:** [April 19, 2024, 1:22pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286/1 "2024-04-19T13:22:36Z")
Hi there. I am working on a chatbot, and I expect it to have a lot of users so I wanna move away from IRC and over to the eventsub architecture. I’m reading the Twitch API docs and I see the following for the Send Chat Message endpoint: > Requires an [app access token](https://dev.twitch.tv/docs/authentication#app-access-tokens) or [user access token](https://dev.twitch.tv/docs/authentication#user-access-tokens) that includes the `user:write:chat` scope. **If app access token used, then additionally requires `user:bot` scope from chatting user, and either `channel:bot` scope from broadcaster or moderator status.** However. I do not understand how I am meant to add a scope to an app access token when using [OAuth Client Credentials Grant Flow](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#client-credentials-grant-flow)? Any explanation and/or help is much appreciated. ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [April 19, 2024, 2:36pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286/2 "2024-04-19T14:36:41Z")
> [@Atlas](#): > > However. I do not understand how I am meant to add a scope to an app access token when using [OAuth Client Credentials Grant Flow](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#client-credentials-grant-flow)? You don’t, the documentation is a little mis worded, as it’s kinda complicated: What you do is - generate a user access token with the needed scopes for your bot - generate a user access token with the needed scopes forthe channel(s) you want to read/write to - store the tokens if you want for API calls - generatea client credentials/app access token - create aubscriptions on eventsub for those channels Notes by transport type: [twitch\_misc/eventsub/websockets/web/chat at main · BarryCarlyon/twitch\_misc · GitHub](https://github.com/BarryCarlyon/twitch_misc/tree/main/eventsub/websockets/web/chat#how-does-authentication-work) ---
**Author:** ![Atlas](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/atlas/32/29870_2.png) [@Atlas](https://discuss.dev.twitch.com/u/Atlas)\ **Post date:** [April 19, 2024, 2:55pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286/3 "2024-04-19T14:55:48Z")
I see. So if I understand correctly. - I use the user access token for the bot with the scope `user:bot` (and chatting) to chat in channels. - I use the user access token for each user with the scope `channel:bot`. But then what do I use the app access token for? This is all very confusing 😂 I have a decent understanding of all the other aspects, but this is pretty confusing to me. ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [April 19, 2024, 3:01pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286/4 "2024-04-19T15:01:03Z")
> [@Atlas](#): > > But then what do I use the app access token for? EventSub over webhooks or conduits. The Chat Send API also supports using an app access token. An example: To connect bot `foo` to `fred`s channel in read/write mode - Generate a user access token for `foo` with `user:read:chat` and `user:write:chat` and `user:bot` - Ask `fred` to authenticate, generating a user access token with `channel:bot` Once thats both done `foo` can read/write to `fred`s channel using the app access token on a webhook or a conduit. And use the same app access token to send on the API Generally in my opinion Chat Bots will use a conduit where the shard(s) are attached to a websocket. So a conduit will require an app access token. The [Send Chat Endpoint](https://dev.twitch.tv/docs/api/reference/#send-chat-message) supports both token types, as it means that your bot doesn’t have to handle multiple tokens, just the app access token to sending messages with and assigning shard to a websocket via the conduit API’s which need an app access token. Sure you’ll still need the bot’s own user token _if_ your bot is doing moderation actions but thats a different discussion ---
**Author:** ![Atlas](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/atlas/32/29870_2.png) [@Atlas](https://discuss.dev.twitch.com/u/Atlas)\ **Post date:** [April 19, 2024, 3:04pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286/5 "2024-04-19T15:04:58Z")
Ah okay. I see. Thank you! 🥰 ---
**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\ **Post date:** [May 19, 2024, 3:05pm UTC](https://discuss.dev.twitch.com/t/app-access-token-with-scopes/58286/6 "2024-05-19T15:05:19Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.