# Did the Oauth requirements not go live?

**URL:** <https://discuss.dev.twitch.com/t/did-the-oauth-requirements-not-go-live/25618>\
**Category:** API\
**Created:** [May 14, 2020, 7:10pm UTC](https://discuss.dev.twitch.com/t/did-the-oauth-requirements-not-go-live/25618 "2020-05-14T19:10:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrgoodbytes8667](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/mrgoodbytes8667/32/6535_2.png) [@mrgoodbytes8667](https://discuss.dev.twitch.com/u/mrgoodbytes8667)\
**Post date:** [May 14, 2020, 7:10pm UTC](https://discuss.dev.twitch.com/t/did-the-oauth-requirements-not-go-live/25618/1 "2020-05-14T19:10:00Z")

</div>

I was under the impression that they’ve been required since May 11th, but it doesn’t actually appear to be required for endpoints that don’t have explicit scope requirements at least.

If I run this:  
curl -X GET ‘[https://api.twitch.tv/helix/games?id=493057](https://api.twitch.tv/helix/games?id=493057)’

I get exactly what I’d expect:  
{“error”:“Unauthorized”,“status”:401,“message”:“OAuth token is missing”}

But if I just hand it a client id  
curl -H ‘Client-ID: [redacted]’ -X GET ‘[https://api.twitch.tv/helix/games?id=493057](https://api.twitch.tv/helix/games?id=493057)’

The data comes right back.  
{“data”:[{“id”:“493057”,“name”:“PLAYERUNKNOWN’S BATTLEGROUNDS”,“box\_art\_url”:“[https://static-cdn.jtvnw.net/ttv-boxart/PLAYERUNKNOWN’S%20BATTLEGROUNDS-{width}x{height}.jpg](https://static-cdn.jtvnw.net/ttv-boxart/PLAYERUNKNOWN%27S%20BATTLEGROUNDS-%7Bwidth%7Dx%7Bheight%7D.jpg)”}]}

Edit: does this have something to do with the age of client IDs? I tried a newer client ID, and it errors out exactly like it should.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 14, 2020, 7:22pm UTC](https://discuss.dev.twitch.com/t/did-the-oauth-requirements-not-go-live/25618/2 "2020-05-14T19:22:59Z")

</div>

> [@mrgoodbytes8667](#):
>
> [redacted]’

Client IDs are public and don’t need to be redacted.

Did you call this using an extension ClientID? Extensions have a little more leeway to update to the new behavious

---

<div class="post-metadata">

**Author:** ![mrgoodbytes8667](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/mrgoodbytes8667/32/6535_2.png) [@mrgoodbytes8667](https://discuss.dev.twitch.com/u/mrgoodbytes8667)\
**Post date:** [May 14, 2020, 7:30pm UTC](https://discuss.dev.twitch.com/t/did-the-oauth-requirements-not-go-live/25618/3 "2020-05-14T19:30:54Z")

</div>

This is one listed under Applications from June of 2018. If I swap to a Client ID from April of 2020, it returns the 401 with OAuth token is missing.

It also appears to not validate that the token and client ID match for these older IDs either. I can even pass through a blatantly fake token, such as ‘abc123’ with the older client IDs and the data comes back just fine. Likewise, I can pass through a valid token from the old client ID and a blatantly fake Client-ID such as ‘abc123’ and it works.

Edit: I just wanted to double check. Generated a new app token via a newer client ID. The token from the new client ID mixed with ‘abc123’ as the client ID gives me 401 Client ID and OAuth token do not match.

I’m not sure if this is a bug, or just something where I should be grateful for these old applications.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [June 13, 2020, 7:30pm UTC](https://discuss.dev.twitch.com/t/did-the-oauth-requirements-not-go-live/25618/4 "2020-06-13T19:30:58Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.