# Getting Oauth Token

**URL:** <https://discuss.dev.twitch.com/t/getting-oauth-token/26472>\
**Category:** API\
**Created:** [June 17, 2020, 2:01pm UTC](https://discuss.dev.twitch.com/t/getting-oauth-token/26472 "2020-06-17T14:01:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Niklas\_v\_G](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/niklas_v_g/32/9240_2.png) [@Niklas\_v\_G](https://discuss.dev.twitch.com/u/Niklas_v_G)\
**Post date:** [June 17, 2020, 2:01pm UTC](https://discuss.dev.twitch.com/t/getting-oauth-token/26472/1 "2020-06-17T14:01:54Z")

</div>

Hey guys,

I dont play often with APIs but a while ago I wrote a bit code too see if one of my friends is live and I used php and Curl to achieve this.

I used:

```auto
    $link = https://api.twitch.tv/helix/streams?user_login=XXX&user_login=YYY;

    $ch = curl_init($link);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
         'Accept: application/vnd.twitchtv.v5+json',
         'Client-ID: *My-Client-ID*',
    ));
    $l1 = curl_exec($ch);
    curl_close($ch);

    $twitch_array = json_decode($l1, true);
    echo "Twitch Array 1: <br>";
    print_r($twitch_array);

```

All worked fine for me but now i get the error:  
`Array ( [error] => Unauthorized [status] => 401 [message] => OAuth token is missing )`

I searched for this error and after a while I found out that Twitch changed there API so that every request needs an Oauth Token but I am not able to generate one of these for me.

I have a Client- and a Secret Id and this Link:

```auto
https://id.twitch.tv/oauth2/token
    --data-urlencode
    ?grant_type=refresh_token
    &refresh_token=REMOVED
    &client_id=fooid
    &client_secret=barbazsecret

```

Can someone explain me how I get the nessesary Oauth token with these 3 things using Curl?

I have this Code now:

```auto
    $url = 'https://id.twitch.tv/oauth2/token--data-urlencode?grant_type=refresh_token&refresh_token=REMMOVED&client_id=dM<-Client-ID&client_secret=My-Secret-ID';

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);
    print_r($response);

```

I deleted the scope part because I think its not needed for “…/streams/…” and I dont know what I should use for the refresh token.

The error is:  
`{"status":400,"message":"invalid URL escape \"%6V\""}`

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [June 17, 2020, 2:11pm UTC](https://discuss.dev.twitch.com/t/getting-oauth-token/26472/2 "2020-06-17T14:11:04Z")

</div>

> [@Niklas\_v\_G](#):
>
> I have a Client- and a Secret Id and this Link:

Removed the refresh token

ClientID’s are public  
ClientSecret, oAuth Tokens, and Refresh tokens are not and should be securet

> [@Niklas\_v\_G](#):
>
> ` $url = 'https://id.twitch.tv/oauth2/token--data-urlencode?grant_type=refresh_token&refresh_token=REMOVED&client_id=dM<-Client-ID&client_secret=My-Secret-ID';`

This is very very wrong

`--data-urlencode` tells you what/how to format the data when using cURL it doesn’t become part of the URL.

```
$ch = curl_init('https://id.twitch.tv/oauth2/?grant_type=refresh_token&refresh_token=REMOVED&client_id=CLIENT&client_secret=SECRET');
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
print_r($response);

```

But this only works if you have a refresh token to use, which I don’t think you do.

You should generate and use an App Access Token/Client Credentials for this

> **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)**
>
> Getting OAuth Access Tokens

---

<div class="post-metadata">

**Author:** ![Niklas\_v\_G](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/niklas_v_g/32/9240_2.png) [@Niklas\_v\_G](https://discuss.dev.twitch.com/u/Niklas_v_G)\
**Post date:** [June 17, 2020, 4:34pm UTC](https://discuss.dev.twitch.com/t/getting-oauth-token/26472/3 "2020-06-17T16:34:47Z")

</div>

I understand now that the Link I used is for a refresh Token but the only thing I want is an simple Oauth Token that my Request:  
`$link = https://api.twitch.tv/helix/streams?user_login=XXX&user_login=YYY;`

works like before the Twitch API Changes.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [June 17, 2020, 4:37pm UTC](https://discuss.dev.twitch.com/t/getting-oauth-token/26472/4 "2020-06-17T16:37:25Z")

</div>

Then you need to generate and store then use an app access token. As covered in the oAuth docs I already linked.

Then pass that token with your request.

An example is on this other Post that is doing similar to what you are doing

> [@New API rules breaking old script, help](https://discuss.dev.twitch.com/t/new-api-rules-breaking-old-script-help/25307/8):
>
> Ok. Really, I can’t thank you all enough for your help. For the benefit of others trying to implement this update on an old-fangled system, I’ll include my solution below. Note that I consider this incomplete, as I haven’t yet added a fallback in the event of token authentication failure. I’ll leave my comments in place. I also noticed that it doesn’t appear to update as quickly as before, there is some delay between the time a stream begins, and the time this function returns as true. Any tho…

But it’s not the recommended solution as this generates an oAuth token every time rather than reusing an old still valid one.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [July 17, 2020, 4:37pm UTC](https://discuss.dev.twitch.com/t/getting-oauth-token/26472/5 "2020-07-17T16:37:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.