# Failing to authenticate EventSub subscriptions

**URL:** <https://discuss.dev.twitch.com/t/failing-to-authenticate-eventsub-subscriptions/61668>\
**Category:** API\
**Created:** [November 6, 2024, 8:36pm UTC](https://discuss.dev.twitch.com/t/failing-to-authenticate-eventsub-subscriptions/61668 "2024-11-06T20:36:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![encephala](https://avatars.discourse-cdn.com/v4/letter/e/e79b87/32.png) [@encephala](https://discuss.dev.twitch.com/u/encephala)\
**Post date:** [November 6, 2024, 8:36pm UTC](https://discuss.dev.twitch.com/t/failing-to-authenticate-eventsub-subscriptions/61668/1 "2024-11-06T20:36:55Z")

</div>

For my client id, I’ve requested a user access token, which is valid:

```bash
> curl -X GET 'https://id.twitch.tv/oauth2/validate' -H 'Authorization: Bearer r2x22...'
{"client_id":"mvkpu...", [...], "scopes":["channel:bot","chat:edit","chat:read"],[...]}

```

Then, my app requests an app access token. Validating this one:

```bash
> curl -X GET 'https://id.twitch.tv/oauth2/validate' -H 'Authorization: Bearer wvsi...'
{"client_id":"mvkpu...","scopes":null,"expires_in":4794596}

```

Then, I try to subscribe to EventSub `channel.chat.message` with this client id `mvkpu...` and bearer auth using the access token. However, that keeps returning

```json
{"error":"Forbidden","status":403,"message":"subscription missing proper authorization"}

```

What could I be doing wrong? The user access token scopes should allow subscribing to `channel.chat.message` as far as I can tell. The Client Id matches between the user access token and the app access token.

Thanks!

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [November 7, 2024, 12:06am UTC](https://discuss.dev.twitch.com/t/failing-to-authenticate-eventsub-subscriptions/61668/2 "2024-11-07T00:06:39Z")

</div>

This sounds like you are trying to use conduits or webhooks, for eventsub know the transport is important information.

This suggests you didn’t get permission from the broadcater to be present _or_ you are a not a mod of the broadcaster in question that you are trying to join.

# Straight websockets

- user token from the user you want to read chat as with `user:read:chat`

# Webhooks or Conduits

Generate a user access token for the user to read chat as (with `user:read:chat` and `user:bot`), and moderator permission, then generate app access (no scopes)

- `user:read:chat` from the user account you wish to read chat as (usually the bot)
- `user:bot` from the user account you wish to act as a bot as
- moderator status in the channel you wish to connect to

or

Generate a user access token for the user to read chat as (with `user:read:chat` and `user:bot`), and a second user access token from the broadcaster of the channel you want to be (with `channel:bot`), then generate app access (no scopes)

- `user:read:chat` from the user account you wish to read chat as (usually the bot)
- `user:bot` from the user account you wish to act as a bot as
- `channel:bot` from the channel you wish to connect to

> **[twitch\_misc/eventsub/websockets/web/chat at main · BarryCarlyon/twitch\_misc](https://github.com/BarryCarlyon/twitch_misc/tree/main/eventsub/websockets/web/chat#how-does-authentication-work)**
>
> Misc. Twitch bits and pieces. Contribute to BarryCarlyon/twitch\_misc development by creating an account on GitHub.

> **[Authenticating and Setting up EventSub](https://dev.twitch.tv/docs/chat/authenticating/#setting-up-eventsub-subscriptions)**
>
> Authenticating and EventSub Registering your bot To get an access token, you must first register your bot. For information about registering your bot, see Registering Your App. Authenticating After registering your bot and getting a client ID, you...

You have shown getting a user token `channel:bot` which is needed for the broacaster token

`chat:edit` and `chat:read` are [“legacy” irc only scopes](https://dev.twitch.tv/docs/authentication/scopes/#irc-chat-scopes) and not used on eventsub.

So practical example:

my bot is `cohhilitionbot` I get a user access token for `cohhilitionbot` with `user:read:chat` and `user:bot`

it needs to talk in `cohhcarnage` so I send a link to cohh with the request to get the permission `channel:bot`

Once thats done I generate an app access token and create subscriptions.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [December 7, 2024, 12:07am UTC](https://discuss.dev.twitch.com/t/failing-to-authenticate-eventsub-subscriptions/61668/3 "2024-12-07T00:07:02Z")

</div>

Closed on December 7, 2024, 12:07am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.