# Get user\_id from OAuth token?

**URL:** <https://discuss.dev.twitch.com/t/get-user-id-from-oauth-token/34408>\
**Category:** API\
**Created:** [October 29, 2021, 3:10am UTC](https://discuss.dev.twitch.com/t/get-user-id-from-oauth-token/34408 "2021-10-29T03:10:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MasterTimeThief](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/mastertimethief/32/14287_2.png) [@MasterTimeThief](https://discuss.dev.twitch.com/u/MasterTimeThief)\
**Post date:** [October 29, 2021, 3:10am UTC](https://discuss.dev.twitch.com/t/get-user-id-from-oauth-token/34408/1 "2021-10-29T03:10:41Z")

</div>

So, my current flow is that I have the user authenticate, and it redirects me to “[website.com?/#access\_token=1234567890ABCDEF](http://website.com?/#access_token=1234567890ABCDEF)”. I want to be able to use the user’s ID at this site, so can I either:

A) Use the OAuth token to get back the broadcaster its tied to? (Probably not a secure idea, but I’ll still ask)  
B) Have the site pass an additional parameter that is just the user ID?

I know there’s a parameter called “state” that I can specify. If I read the doc correctly, the idea is to give it some token that _I_ made, and then have it get sent back as a security precaution. Would it be possible to use the user ID for that, or at least embed it in “state” without it being a security problem?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [October 29, 2021, 9:53am UTC](https://discuss.dev.twitch.com/t/get-user-id-from-oauth-token/34408/2 "2021-10-29T09:53:48Z")

</div>

> [@MasterTimeThief](#):
>
> So, my current flow is that I have the user authenticate, and it redirects me to “[website.com?/#access\_token=1234567890ABCDEF](http://website.com?/#access_token=1234567890ABCDEF)”. I want to be able to use the user’s ID at this site, so can I either:

This is implicity auth

To get the user ID extract the access token from the URL hash

and pass the Token to the get users API, and this will return the user for that token, here is that example

[https://barrycarlyon.github.io/twitch\_misc/authentication/implicit\_auth/](https://barrycarlyon.github.io/twitch_misc/authentication/implicit_auth/)

> [@MasterTimeThief](#):
>
> A) Use the OAuth token to get back the broadcaster its tied to? (Probably not a secure idea, but I’ll still ask)

This is the correct method, and literally the purpose of oAuth

> [@MasterTimeThief](#):
>
> B) Have the site pass an additional parameter that is just the user ID?

You don’t have the user ID. So how do you pass an additional parameter with the user ID in?

> [@MasterTimeThief](#):
>
> Would it be possible to use the user ID for that, or at least embed it in “state” without it being a security problem?

Same problem you don’t have the user ID in order to put it in state.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [November 28, 2021, 9:53am UTC](https://discuss.dev.twitch.com/t/get-user-id-from-oauth-token/34408/3 "2021-11-28T09:53:54Z")

</div>

Closed on November 28, 2021, 9:53am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.