# Error 401 with new API

**URL:** <https://discuss.dev.twitch.com/t/error-401-with-new-api/25428>\
**Category:** API\
**Created:** [May 6, 2020, 8:47pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428 "2020-05-06T20:47:10Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 8:47pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/1 "2020-05-06T20:47:10Z")

</div>

Hello,

Since the update, all my api are crashed, what should I add ? I’m french I don’t understand well the documentation, here is my code that worked before the patch.

```
$.ajax({
	dataType: "json",
	url: "https://api.twitch.tv/helix/streams?first=6&language=fr&game_id={{ gametwitchid }}",
	headers: {
				"Client-ID": "myIDkeyclient",
		},

```

Thanks for help

---

<div class="post-metadata">

**Author:** ![Dist](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://discuss.dev.twitch.com/u/Dist)\
**Post date:** [May 6, 2020, 8:49pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/2 "2020-05-06T20:49:39Z")

</div>

You need to add the `Authorization: Bearer <YourOAuthToken>` header.

Here are the step by step guide on what to do: [https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-client-credentials-flow](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-client-credentials-flow)

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 9:09pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/3 "2020-05-06T21:09:44Z")

</div>

Thank you for your answer, like this?

```
				headers: {
					"access_token": "mytoken",
					"Client-ID": "myid",
					"token_type": "bearer",
				},
```

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 9:11pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/4 "2020-05-06T21:11:31Z")

</div>

```auto
				headers: {
					"Authorization": "Bearer mytoken",
					"Client-ID": "myid"
				},

```

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 9:16pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/5 "2020-05-06T21:16:45Z")

</div>

Thanks for the feedback, but it’s still broken since the patch now I have error 401  
{“error”:“Unauthorized”,“status”:401,“message”:“OAuth token is missing”}

dataType: “json”,  
url: “[https://api.twitch.tv/helix/streams?first=6&language=fr&game\_id=](https://api.twitch.tv/helix/streams?first=6&language=fr&game_id=){{ gametwitchid }}”,  
headers: {  
“Authorization”: “Bearer mytoken”,  
“Client-ID”: “myclientid”,  
},

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 9:48pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/6 "2020-05-06T21:48:38Z")

</div>

“mytoken” is a generated token and not your client secret?

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 9:50pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/7 "2020-05-06T21:50:01Z")

</div>

this one we’re okay with?

 ![Sans titre 1](https://d2opxh93rbxzdn.cloudfront.net/original/2X/e/e9a3644dd15cd8cc43cf21217a71a6d3d9fdbba2.jpeg)

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 9:51pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/8 "2020-05-06T21:51:01Z")

</div>

That is your Client Secret, you use the Client ID and the Client Secret to create an oAuth token,

Then you use that generated token

As Dist linked to earlier

> **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)**
>
> Getting OAuth Access Tokens

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 9:54pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/9 "2020-05-06T21:54:58Z")

</div>

it’s complicated the… everything worked fine now I have my whole site in PLS :S I don’t even know how to do that…

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 9:57pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/10 "2020-05-06T21:57:22Z")

</div>

You appear to be doing this via jQuery .ajax

That is front end logic, so that would suggest you need an implicit oAuth code (via making users login via Twitch)

But if you are displaying streams on a website, then it’s more performant to collect the streams you want to show using a cron job, and cache that information on your server, so your website loads from that cache instead of polling Twitch every page load.

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 10:32pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/11 "2020-05-06T22:32:26Z")

</div>

Do you have any idea how to disguise the returned Token authorization?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 10:32pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/12 "2020-05-06T22:32:57Z")

</div>

`disguise`? What do you mean disguise?

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 10:41pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/13 "2020-05-06T22:41:40Z")

</div>

Hide\* sorry

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 10:42pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/14 "2020-05-06T22:42:19Z")

</div>

Again not sure what you intend to do by hideing it?

Since You are all front end code here, you can’t hide anything.

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 10:43pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/15 "2020-05-06T22:43:43Z")

</div>

Are there any security problems? I only use it to display channels via twitch, no link with the database or other.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 10:44pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/16 "2020-05-06T22:44:50Z")

</div>

If users login to your site and you use the users token, thats fine.

If you generate an App Access Token and use that, then thats a problem as you are leaking, what is essenitally a password. And you’d have to leak your clietnt secret, to generate the App Access Code in front end code

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 10:47pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/17 "2020-05-06T22:47:51Z")

</div>

In summary:

My site doesn’t use any api twitch login or password for users.  
The API only displays frontend strings without any link to the site’s database.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [May 6, 2020, 10:48pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/18 "2020-05-06T22:48:35Z")

</div>

Then you need to refactor your code, so your front end calls your backend and the backend calls Twitch.

Your frontend can no longer call Twitch directly

---

<div class="post-metadata">

**Author:** ![INFINITY](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/infinity/32/8578_2.png) [@INFINITY](https://discuss.dev.twitch.com/u/INFINITY)\
**Post date:** [May 6, 2020, 10:49pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/19 "2020-05-06T22:49:34Z")

</div>

Ok thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [June 5, 2020, 10:49pm UTC](https://discuss.dev.twitch.com/t/error-401-with-new-api/25428/20 "2020-06-05T22:49:38Z")

</div>

Closed on June 5, 2020, 10:49pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.