Does the `channel_read` scope work with the OAuth Client Credentials Flow?

API
1

Hey folks - I’m having trouble requesting channel info from the https://api.twitch.tv/kraken/channel/ endpoint using the OAuth Client Credentials Flow.

I’ve obfuscated client_secret and the OAuth access token only has the channel_read scope, so feel free to copy-paste examples.

Here’s the cURL request getting the access token:

curl -X POST https://api.twitch.tv/kraken/oauth2/token?client_id=ri04jcik58c8pt9jj8wcol85jrv3t7&client_secret=asdfasdfasdf&grant_type=client_credentials&scope=channel_read

Along with the response:

{"access_token":"e1bbk2ryuhqydcelkpfc5n5qascmxd","refresh_token":"","scope":["channel_read"],"expires_in":4697541}

Cool, got my access token. Hitting the https://api.twitch.tv/kraken/ endpoint just to verify that the token is valid, and has the correct scopes:

curl -H 'Authorization: OAuth e1bbk2ryuhqydcelkpfc5n5qascmxd' \
-H 'Accept: application/vnd.twitchtv.v5+json' \
-H 'Client-ID: ri04jcik58c8pt9jj8wcol85jrv3t7' \
-X GET 'https://api.twitch.tv/kraken/'

And the response, indicating that it’s valid and has the channel_read scope:

{"token":{"valid":true,"authorization":{"scopes":["channel_read"],"created_at":"2017-12-28T22:55:50Z","updated_at":"2017-12-28T22:55:50Z"},"client_id":"ri04jcik58c8pt9jj8wcol85jrv3t7","expires_in":4697495}}

Now, trying to get my channel info from the https://api.twitch.tv/kraken/channel/ endpoint:

curl -H 'Authorization: OAuth e1bbk2ryuhqydcelkpfc5n5qascmxd' \
-H 'Accept: application/vnd.twitchtv.v5+json' \
-H 'Client-ID: ri04jcik58c8pt9jj8wcol85jrv3t7' \
-X GET 'https://api.twitch.tv/kraken/channel/'

Aaaaaand

{"error":"Unauthorized","status":401,"message":"authentication failed"}

Womp womp. I have a hunch that this might not work with the OAuth Client Credentials flow, but I figured I’d post here to see if anyone had a definite answer, or if I’m just missing something crucial.

I can get this done using some of the other auth methods, but as the app I’m building is server-side only I figure I’d give this a shot.

Appreciate any thoughts that you guys have. Cheers!

2

It does not.

You need a User Access Token since you are requesting data on behalf of a user’s account.

https://dev.twitch.tv/docs/authentication (2nd table under “Getting Tokens”)

3

Thanks! Appreciate the response.

4

Also to note since channel_read provides access to the channel’s stream key it is a scope you almost never want to request unless of course you need the stream key.