# Invalid oauth\_token on /channel

**URL:** <https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110>\
**Category:** API\
**Created:** [June 7, 2018, 9:42am UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110 "2018-06-07T09:42:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![azorgh](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/azorgh/32/4627_2.png) [@azorgh](https://discuss.dev.twitch.com/u/azorgh)\
**Post date:** [June 7, 2018, 9:42am UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110/1 "2018-06-07T09:42:53Z")

</div>

Hi there 🙂

I made a server side script to get channel details (and more in the future).

Step 1 : I generate a new OAuth token with the channel\_read scope. Everything is fine, when I debug the response, I got the token, valid at true, my client id, and a expires\_in data.

Step 2 : I hit the /channel endpoint, with the Authorization header and the token given. But I got a “invalid oauth token” response.

The token was just generated, how it’s possible to have a invalid one ?

Here the headers of my request :

```
> GET /kraken/channel HTTP/1.1
Host: api.twitch.tv
Authorization: OAuth eg8k1yyb3vm4fq75miqt **********
Accept: application/vnd.twitchtv.v5+json
Client-ID: ilickoxxp9y3t9x89z1v **********
User-Agent: GuzzleHttp/6.3.3 curl/7.47.0 PHP/7.1.16-1+ubuntu16.04.1+deb.sury.org+1

```

And there is the response :  
`{"error":"Unauthorized","status":401,"message":"invalid oauth token"}`

I really don’t understand why ☹

Thanks for your help !

---

<div class="post-metadata">

**Author:** ![Buran](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/buran/32/4238_2.png) [@Buran](https://discuss.dev.twitch.com/u/Buran)\
**Post date:** [June 7, 2018, 1:55pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110/2 "2018-06-07T13:55:55Z")

</div>

Not sure what is wrong here (haven’t tried to use v5 for some time) but I would do a few checks:

1. Are you sure you use HTTPS?
2. Try this request with the same token using some local tool like curl/postman. Do you see the same error?

---

<div class="post-metadata">

**Author:** ![Dist](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://discuss.dev.twitch.com/u/Dist)\
**Post date:** [June 7, 2018, 2:44pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110/3 "2018-06-07T14:44:07Z")

</div>

Have you tried sending a request to the root kraken domain, ie `https://api.twitch.tv/kraken` as that’ll respond with the validity and scopes of the token so is a good way check the status of the token.

---

<div class="post-metadata">

**Author:** ![azorgh](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/azorgh/32/4627_2.png) [@azorgh](https://discuss.dev.twitch.com/u/azorgh)\
**Post date:** [June 7, 2018, 2:57pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110/4 "2018-06-07T14:57:05Z")

</div>

I’ve found the solution.

In fact, I don’t need the oauth key provided by this endpoint (server-\>server).  
I’ve generated a auth key with this website : [https://twitchtokengenerator.com](https://twitchtokengenerator.com)

And the script works well with the given oauth token. My script juste refresh the token to be sure it is not expired.

Well, thanks for your answers guys,  
\<3

---

<div class="post-metadata">

**Author:** ![Dist](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://discuss.dev.twitch.com/u/Dist)\
**Post date:** [June 7, 2018, 3:41pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110/5 "2018-06-07T15:41:14Z")

</div>

> [@azorgh](#):
>
> In fact, I don’t need the oauth key provided by this endpoint (server-\>server).

Yeah, for future reference for anyone else who may run into this and want to get tokens themselves rather than use 3rd party sites like that to get tokens for you, you need to get a User token rather than an App token.

App tokens are for server to server requests that are NOT associated with a user (and and such can not be used on endpoints that require user authentication, as the the channel endpoint mentioned in this thread).

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [July 7, 2018, 3:41pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-on-channel/16110/6 "2018-07-07T15:41:17Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.