# App authentication on order to get access\_token **URL:** \ **Category:** API\ **Created:** [October 23, 2016, 3:28pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886 "2016-10-23T15:28:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Dragon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dragon/32/137_2.png) [@Dragon](https://discuss.dev.twitch.com/u/Dragon)\ **Post date:** [October 23, 2016, 3:28pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/1 "2016-10-23T15:28:27Z")
I have a chat bot written in .NET/C#, it doesn’t use web browser and all communication is done via Twitch API. I decided to add functionality for setting stream title and game. This requires authentication and and corresponding scope usage (channel\_editor). I have client\_id, client\_secret, OAuth token. Also bot is set as moderator on my channel, but it still needs to be authenticated in order to get access\_token which is required for “PUT /channels/:channel/”. There’s no need in authentication for data read, in some cases OAuth may be required. But in this case it intends to update channel data. When I try to get access\_token I’m redirected to app authentication page instead of being redirected to page with code (https://[your registered redirect URI]/?code=[CODE]). But I cannot authorize it because I see this page only in httpWebResponse as byte array. So here is how I do it [Authorization Code Flow]: String.Format(“[https://api.twitch.tv/kraken/oauth2/authorize?response\_type=code&client\_id={0}&redirect\_uri={1}&scope=channel\_editor&state={2}](https://api.twitch.tv/kraken/oauth2/authorize?response_type=code&client_id=%7B0%7D&redirect_uri=%7B1%7D&scope=channel_editor&state=%7B2%7D)”, CLIENT\_ID, REDIRECT\_URI, OAUTH\_TOKEN); var httpWebRequest = (HttpWebRequest)WebRequest.Create(url); httpWebRequest.AllowAutoRedirect = true; httpWebRequest.Method = “GET”; using (var httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse()) { //response URL is expected here } I also tried Implicit Grant Flow, but result is the same. Bot needs authentication. Is there any way to get access\_token in order to set stream title and game? Or what am I doing wrong? ---
**Author:** ![3ventic](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/3ventic/32/298_2.png) [@3ventic](https://discuss.dev.twitch.com/u/3ventic)\ **Post date:** [October 23, 2016, 4:44pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/2 "2016-10-23T16:44:41Z")
There’s no way around the browser requirement, but you can get a token outside of the bot and then place it in its configs/settings/whatever. One option would be to make a website to handle the authorization, which would then send the token to the bot automatically. ---
**Author:** ![Dragon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dragon/32/137_2.png) [@Dragon](https://discuss.dev.twitch.com/u/Dragon)\ **Post date:** [October 23, 2016, 6:55pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/3 "2016-10-23T18:55:55Z")
I tried to retrieve token in the browser and save it (let’s say in DB). But it seems that this token expires after one usage in any web request. Because next request demands new token or authentication. ---
**Author:** ![3ventic](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/3ventic/32/298_2.png) [@3ventic](https://discuss.dev.twitch.com/u/3ventic)\ **Post date:** [October 23, 2016, 10:08pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/4 "2016-10-23T22:08:40Z")
Twitch oauth tokens do not expire. ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [October 24, 2016, 4:59pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/5 "2016-10-24T16:59:08Z")
Sounds like you are storing/recalling the code instead of the access token. The code can be redeemed for an access token once. You should then store the access token and use that for subsequent requests. Auth flow is: - Generate Auth URL - Redirect User to Twitch - Twitch returns to callback url with code - Exchange code for access token - Store and use access token ---
**Author:** ![Dragon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dragon/32/137_2.png) [@Dragon](https://discuss.dev.twitch.com/u/Dragon)\ **Post date:** [October 24, 2016, 5:53pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/6 "2016-10-24T17:53:08Z")
Oh, it seems I understood what I was doing wrong. I need to go through the flow as described for “Authorization Code Flow” up to the step with the following response: > { > “access\_token”: “[user access token]”, > “scope”:[array of requested scopes] > } And use this access\_token in PUT request scenario for setting channel title. And this is the token which doesn’t expire as 3ventic said. Am I right? Thank you for detailed explanation. ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [October 24, 2016, 6:16pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/7 "2016-10-24T18:16:58Z")
You got it 🙂 The returned access\_token is what you use in the PUT Request ---
**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\ **Post date:** [November 23, 2016, 6:17pm UTC](https://discuss.dev.twitch.com/t/app-authentication-on-order-to-get-access-token/7886/8 "2016-11-23T18:17:18Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.