revoked. thanks for noticing this. let me clarify how the url is formed. the following function is within the twitch.lua:
function M.get_oauth_url(user, stream_id)
return format('%s/oauth2/authorize?',api_url)..
encode_query_string({
response_type = 'code',
force_verify = 'true',
redirect_uri = M.redirect_uri,
client_id = twitch_config.client_id,
state = encode_base64(encode_with_secret({ id = user.id, stream_id = stream_id })),
scope = 'user_read channel_read channel_editor channel_stream chat_login',
})
meaning that once a user authorized the app through twitch, it writes the information it gets into database. this step is fine, having the user authorizing ‘by hand’.
local body = encode_query_string({
client_id = twitch_config.client_id,
client_secret = twitch_config.client_secret,
redirect_uri = M.redirect_uri,
code = params.code,
state = params.state,
refresh_token = refresh_token,
grant_type = 'authorization_code',
})
this generates (and encodes) the EXACT database info which should be used once a stream is up. so, basically everything goes to the following function which fails after the expiration of the refresh_token:
for _,account in pairs(self.accounts) do
local sa = StreamAccount:find({ stream_id = self.stream.id, account_id = account.id })
if sa then
local rtmp_url, err = networks[account.network].publish_start(account:get_keystore(),sa:get_keystore())
if (not rtmp_url) or err then
self.session.status_msg = { type = 'error', msg = 'Failed to start pusher: ' .. err}
ngx_log(ngx_warn,format(
'app:publish-start: failed to start %s (%s): %s',
account.name,
networks[account.network].name,
err
))
return { redirect_to = self:url_for('stream-edit', { id = self.stream.id }) .. '?subset=dashboard' }
end
sa:update({rtmp_url = rtmp_url})
insert(sas, sa)
end
end
i know that there is something within the code, but i’m crippled to find out 
again - thanks for your effort!