# "Invalid OAuth token" when making a request **URL:** \ **Category:** API\ **Created:** [February 23, 2022, 3:51pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060 "2022-02-23T15:51:11Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![isak102](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/isak102/32/17085_2.png) [@isak102](https://discuss.dev.twitch.com/u/isak102)\ **Post date:** [February 23, 2022, 3:51pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/1 "2022-02-23T15:51:12Z")
I followed the instructions at [this url](https://dev.twitch.tv/docs/api) and everything went well, up until “next steps”. I want to make a request which gets all the streamers I am following and prints out which are live. This can be found at [this url](https://dev.twitch.tv/docs/api/reference#get-followed-streams). I copied the example code and replaced the client-id with the client ID I got in the previous steps, and I replaced the token with the token I got in the previous steps, I’m refering to this output: ```auto $ twitch token No Client ID or Secret found in configuration. Triggering configuration now. Client ID: wbmytr93xzw8zbg0p1izqyzzc5mbiz Client Secret: REMOVED Updated configuration. 2021/07/30 20:20:06 App Access Token: REMOVED ``` where it says “App Acess Token”. When I try to make that request, I get the output ```auto {"error":"Unauthorized","status":401,"message":"Invalid OAuth token"} ``` To be clear, the request I am making is this: ```auto curl -X GET 'https://api.twitch.tv/helix/streams/followed?user_id=141981764' \ -H 'Authorization: Bearer ' \ -H 'Client-Id: ' ``` What am I doing wrong here? ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [February 23, 2022, 3:54pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/2 "2022-02-23T15:54:01Z")
# DO NOT EVER POST YOUR CLIENT SECRET PUBLICALLY Secondly # DO NOT POST GENERATED TOKENS PUBLICALLY The generated token, that I removed from your Post, is not a valid token. (And was about to not be as I was about to revoke it for security reasons) So the token couldn’t be used with the API. You should also cycle your leaked client secret You can use a tool like [Token Checker | Twitch API Example](https://barrycarlyon.github.io/twitch_misc/examples/token_checker/) to test if a token is valid, or [Authentication | Twitch Developers](https://dev.twitch.tv/docs/authentication#validating-requests) It seems that you generate a token in the CLI but then that token was no longer valid when making the curl call specified ---
**Author:** ![isak102](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/isak102/32/17085_2.png) [@isak102](https://discuss.dev.twitch.com/u/isak102)\ **Post date:** [February 23, 2022, 4:00pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/3 "2022-02-23T16:00:15Z")
That token and client secret was not mine, I copied it from the instruction page to not leak my own information. But if the token isn’t valid then how do I get a token? Are the instructions on [Twitch API | Twitch Developers](https://dev.twitch.tv/docs/api) not correct? ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [February 23, 2022, 4:03pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/4 "2022-02-23T16:03:31Z")
> [@isak102](#): > > But if the token isn’t valid then how do I get a token? Are the instructions on [Twitch API | Twitch Developers](https://dev.twitch.tv/docs/api) not correct? These instructions are correct. Normally for script based operations you would generate a Client Credentials token as outlined here > **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)** > > Getting OAuth Access Tokens But the type of token needed will depend on the endpoint you are calling, for streams/followed you will need a user access token with permission from the user `141981764` to read their data Which is This kind of token instead > **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)** > > Getting OAuth Access Tokens or > **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)** > > Getting OAuth Access Tokens If you followed the guide and generated a token, you generated an App Access Token. An App Access Token cannot be used to call the streams/followed API that needs a user token > **[Reference](https://dev.twitch.tv/docs/api/reference/)** > > Twitch Developer tools and services to integrate Twitch into your development or create interactive experience on twitch.tv. With the scope `user:read:follows` This will require a webpage that you redirect the user to, to grant permission between their account and your own ClientID ---
**Author:** ![isak102](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/isak102/32/17085_2.png) [@isak102](https://discuss.dev.twitch.com/u/isak102)\ **Post date:** [February 23, 2022, 4:09pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/5 "2022-02-23T16:09:36Z")
Okay thanks, but I am making a program that just lists out the streamers who are currently live and that I am following, I am not planning to release this to anyone, it will be only for personal use. I have had an application like this for months but now I have to move it to the new API because the old one is losing support, and I don’t remember that I had to go through this entire process before. Is there not an easier way to get a OAuth token just for personal use? Before I could just log in to a site and I got a token, didn’t have to do anything ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [February 23, 2022, 4:11pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/6 "2022-02-23T16:11:33Z")
> [@isak102](#): > > Is there not an easier way to get a OAuth token just for personal use? You could generate such a token via the cli (see the `-u` flag) > Otherwise no, to grant access between yourself and your own client ID, on data that requires a scope will require an oAuth flow to get a token (and refresh token). > [@isak102](#): > > Before I could just log in to a site and I got a token, didn’t have to do anything Sounds like you were using a third party token generator which generally is not a good idea. ---
**Author:** ![isak102](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/isak102/32/17085_2.png) [@isak102](https://discuss.dev.twitch.com/u/isak102)\ **Post date:** [February 23, 2022, 4:22pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/7 "2022-02-23T16:22:50Z")
When I use “twitch token -u” my browser opens up in [https://localhost](https://localhost) and then nothing more happens And I dont really understand the instructions at [Getting Tokens: OAuth | Twitch Developers](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-authorization-code-flow) , Am I supposed to make a GET request in the terminal like this: ```auto GET 'https://id.twitch.tv/oauth2/authorize?response_type=token&client_id=&redirect_uri=http://localhost&scope=user_read_follows ``` That doesn’t work for me, I get the output `LWP will support https URLs if the LWP::Protocol::https module is installed.` ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [February 23, 2022, 4:26pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/8 "2022-02-23T16:26:43Z")
> [@isak102](#): > > When I use “twitch token -u” my browser opens up in [https://localhost](https://localhost) and then nothing more happens As per the github I linked: > **IMPORTANT** > > To use user tokens, you will need to set up your Client ID provided during [`configure`](https://github.com/twitchdev/twitch-cli/blob/main/docs/configure.md) with a redirect URI of `http://localhost:3000`. App access tokens will work without this step. You can configure that [on the Twitch Developer console](https://dev.twitch.tv/console). > [@isak102](#): > > And I dont really understand the instructions at [Getting Tokens: OAuth | Twitch Developers](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-authorization-code-flow) , Am I supposed to make a GET request in the terminal like this: No that is a URL you open in a browser/send the user to This is an implict auth example that demonstrates the flow [https://barrycarlyon.github.io/twitch\_misc/authentication/implicit\_auth/](https://barrycarlyon.github.io/twitch_misc/authentication/implicit_auth/) 1 .You generate a `&redirect_uri=http://localhost&scope=user_read_follows` 2. The user (in this case you) clicks that link accepts/declines the account link. 3. Then the user is redirected to `http://localhost` as the declared redirect 4. This will have a `?code=` in the query string parameters. 5. You can then exchange that `?code=` for an access and refresh token. The example I linked differs at step 4: as for implict auth 1. This will have a `#access_token=` to extract and use Implicit tokens cannot be refresh like a “regular” token ---
**Author:** ![isak102](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/isak102/32/17085_2.png) [@isak102](https://discuss.dev.twitch.com/u/isak102)\ **Post date:** [February 23, 2022, 4:32pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/9 "2022-02-23T16:32:53Z")
Thanks I think I understand how its supposed to work now, but I get the response `{"status":400,"message":"invalid scope requested: 'user_read_follows'"}`. In the instruction it says the scope should be space separated but I tried that too and it didn’t work, how am I supposed to write the scope parameter? ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [February 23, 2022, 4:33pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/10 "2022-02-23T16:33:50Z")
The scope is `user:read:follows` If you were requesting multiple scopes you’d put a space between each scope `user:read:follows another:scope a:third:scope` ---
**Author:** ![isak102](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/isak102/32/17085_2.png) [@isak102](https://discuss.dev.twitch.com/u/isak102)\ **Post date:** [February 23, 2022, 4:37pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/11 "2022-02-23T16:37:10Z")
Thank you so much for taking your time to help me, managed to get everything to work now! Have a great day ---
**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\ **Post date:** [March 25, 2022, 4:37pm UTC](https://discuss.dev.twitch.com/t/invalid-oauth-token-when-making-a-request/37060/12 "2022-03-25T16:37:50Z")
Closed on March 25, 2022, 4:37pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.