# Getting a token: 400 Bad Request

**URL:** <https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250>\
**Category:** API\
**Created:** [July 21, 2020, 8:14am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250 "2020-07-21T08:14:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![11148](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/11148/32/9723_2.png) [@11148](https://discuss.dev.twitch.com/u/11148)\
**Post date:** [July 21, 2020, 8:14am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/1 "2020-07-21T08:14:08Z")

</div>

When I try to get a token, I only get an error “400 Bad Request”.

```
$urlp="https://id.twitch.tv/oauth2/token?client_id=".$this->APIkey."&client_secret=".$this->APIkeySecr."&grant_type=client_credentials";
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_URL, $urlp);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
	curl_setopt($ch, CURLOPT_POST, 1);
	$data = curl_exec($ch);

```

At the localhost everything works.  
I checked the code on two servers, everywhere there is a 400 error.  
Maybe the [rfcs.ru](http://rfcs.ru) domain is banned? Or what could be the reason?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [July 21, 2020, 11:13am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/2 "2020-07-21T11:13:19Z")

</div>

Everything looks OK here.

I tried

```
<?php

$ch = curl_init('https://id.twitch.tv/oauth2/token?client_id=' . CLIENT_ID . '&client_secret=' . CLIENT_SECRET . '&grant_type=client_credentials');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, true);

$r = curl_exec($ch);
$i = curl_getinfo($ch);
curl_close($ch);

if ($i['http_code'] == 200) {
    $data = json_decode($r);
    if (json_last_error() == JSON_ERROR_NONE) {
        echo 'Got token';
        print_r($data);
    } else {
        echo 'Failed to parse JSON';
    }
} else {
    echo 'Failed with ' . $i['http_code'] . ' ' . $r;
}

```

and

```
<?php

$ch = curl_init('https://id.twitch.tv/oauth2/token');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'client_id' => CLIENT_ID,
    'client_secret' => CLIENT_SECRET,
    'grant_type' => "client_credentials"
));

$r = curl_exec($ch);
$i = curl_getinfo($ch);
curl_close($ch);

if ($i['http_code'] == 200) {
    $data = json_decode($r);
    if (json_last_error() == JSON_ERROR_NONE) {
        echo 'Got token';
        print_r($data);
    } else {
        echo 'Failed to parse JSON';
    }
} else {
    echo 'Failed with ' . $i['http_code'] . ' ' . $r;
}

```

Change your code to also echo out the body not just the HTTP code, there should be an error message in the body that’ll provider further advice.

---

<div class="post-metadata">

**Author:** ![11148](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/11148/32/9723_2.png) [@11148](https://discuss.dev.twitch.com/u/11148)\
**Post date:** [July 21, 2020, 11:36am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/3 "2020-07-21T11:36:12Z")

</div>

Using the brute-force method, I found a working option:

$urlp=“[https://id.twitch.tv/oauth2/token?client\_id=".$this-\>APIkey."&client\_secret=".$this-\>APIkeySecr."&grant\_type=client\_credentials](https://id.twitch.tv/oauth2/token?client_id=%22.%24this-%3EAPIkey.%22&client_secret=%22.%24this-%3EAPIkeySecr.%22&grant_type=client_credentials)”;

```
	$fields = array(
		'__V' => '1'
	);
	$fields_string = http_build_query($fields);

	$ch = curl_init();
	curl_setopt($ch,CURLOPT_URL, $urlp);
	curl_setopt($ch,CURLOPT_POST, true);
	curl_setopt($ch,CURLOPT_POSTFIELDS, $fields_string);
	curl_setopt($ch,CURLOPT_RETURNTRANSFER, true); 
	$data = curl_exec($ch);

```

Thanks to all!

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [July 21, 2020, 11:39am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/4 "2020-07-21T11:39:49Z")

</div>

If that works where your former script didn’t that would suggest you have different versions of PHP on local and live

And thus different php.ini and different defaults.

Rather than sending trash in the POSTFIELDS you could send the whole payload  
Or declare a header to declare what content type you are sending.

So a

```
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));

```

Might solve your issue.

---

<div class="post-metadata">

**Author:** ![11148](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/11148/32/9723_2.png) [@11148](https://discuss.dev.twitch.com/u/11148)\
**Post date:** [July 21, 2020, 11:41am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/5 "2020-07-21T11:41:41Z")

</div>

Most likely, it was necessary to transfer any data to the CURLOPT\_POSTFIELDS.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [July 21, 2020, 11:43am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/6 "2020-07-21T11:43:29Z")

</div>

I didn’t using this script [https://github.com/BarryCarlyon/twitch\_misc/blob/master/authentication/app\_access\_tokens/php/generate\_token\_as\_qs.php](https://github.com/BarryCarlyon/twitch_misc/blob/master/authentication/app_access_tokens/php/generate_token_as_qs.php)

Which I wrote this morning to test this thread

Also corrected my original reply due to bad copy paste of my script. I need to go find some coffee

 ![image](https://d2opxh93rbxzdn.cloudfront.net/original/2X/9/9ec6689a8937bf98d8349c3b9d23bc4ebef7cfd2.png)

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [August 20, 2020, 11:43am UTC](https://discuss.dev.twitch.com/t/getting-a-token-400-bad-request/27250/7 "2020-08-20T11:43:30Z")

</div>

Closed on August 20, 2020, 11:43am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.