# Custom API Parameters - How?

**URL:** <https://discuss.dev.twitch.com/t/custom-api-parameters-how/12238>\
**Category:** API\
**Created:** [September 29, 2017, 1:34pm UTC](https://discuss.dev.twitch.com/t/custom-api-parameters-how/12238 "2017-09-29T13:34:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ItsTheo](https://avatars.discourse-cdn.com/v4/letter/i/8797f3/32.png) [@ItsTheo](https://discuss.dev.twitch.com/u/ItsTheo)\
**Post date:** [September 29, 2017, 1:34pm UTC](https://discuss.dev.twitch.com/t/custom-api-parameters-how/12238/1 "2017-09-29T13:34:49Z")

</div>

Hello Twitch Developers!

I’ve used Google and the search function on here so far and i found some interesting informations.

If i understand that right, you can pass custom parameters through the state parameter.  
But how can i access the data after the user logged in?

What i tried so far:

send encoded Base64 data over the state Parameter; can’t access it. The JSON Object after login does not contain this.

So, how could this even be realized? Or: Is it even possible?!

Best regards.

---

<div class="post-metadata">

**Author:** ![IllusionaryOne](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/illusionaryone/32/2011_2.png) [@IllusionaryOne](https://discuss.dev.twitch.com/u/IllusionaryOne)\
**Post date:** [September 29, 2017, 11:55pm UTC](https://discuss.dev.twitch.com/t/custom-api-parameters-how/12238/2 "2017-09-29T23:55:23Z")

</div>

The state parameter is a part of OAuth2 to validate that you are receiving back the same request that you sent to the service for authentication and mitigate attacks:

> **[State Parameter](https://auth0.com/docs/protocols/oauth2/oauth-state)**
>
> Explains how to use the state parameter in authentication requests to help prevent CSRF attacks and restore state

Also, the JSON object doesn’t contain it, it comes back as part of the redirect\_uri, from Twitch docs:

```auto
Here is a sample response with both an ID token and access token:

https://localhost#access_token=pk2bh6y1vi8mrn7l67bp9i6dpg2wnk
&token_type=bearer
&id_token=eyJhbGciOiJ...A
&state=c3ab8aa609ea11e793ae92361f002671
	&scope=viewing_activity_read

```

The suggestion is, to encode your original state value before sending it, then upon retrieval, decoding it, and verifying that it is correct.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [October 29, 2017, 11:55pm UTC](https://discuss.dev.twitch.com/t/custom-api-parameters-how/12238/3 "2017-10-29T23:55:30Z")

</div>

Closed on October 29, 2017, 11:55pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.