# Oauth for all Helix endpoints

**URL:** <https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191>\
**Category:** API\
**Created:** [April 26, 2020, 10:22am UTC](https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191 "2020-04-26T10:22:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![burlesque](https://avatars.discourse-cdn.com/v4/letter/b/d07c76/32.png) [@burlesque](https://discuss.dev.twitch.com/u/burlesque)\
**Post date:** [April 26, 2020, 10:22am UTC](https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191/1 "2020-04-26T10:22:32Z")

</div>

I’m not really sure what to do. I’ve just read the announcement that we need to use Oauth for **ALL** Helix endpoints. The only endpoint I use is [get streams](https://dev.twitch.tv/docs/api/reference#get-streams). The docs for that endpoint say that none authentication is needed but at the begging of the page, it says that **Documentation will be updated as these requirements go into effect**. And if I indeed need Oauth for that endpoint I have no idea which token type I need.

Any advice is welcome.  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 26, 2020, 10:23am UTC](https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191/2 "2020-04-26T10:23:32Z")

</div>

Any token will work as that API endpoint doesn’t require any scopes.

App Access tokens aka server to server tokens, will generally fit the best. (But don’t use these in front end code)

> **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)**
>
> Getting OAuth Access Tokens

Threw a uservoice up for your documentation notes

> **[Documentation not updated for oAuth changes on Helix](https://twitch.uservoice.com/forums/310213-developers/suggestions/40270633-documentation-not-updated-for-oauth-changes-on-hel)**
>
> As per
> 
> https://discuss.dev.twitch.tv/t/requiring-oauth-for-helix-twitch-api-endpoints/23916
> 
> None of the documentation is updated to reflect this change.
> 
> Yes it's not required yet. But it's good practice for new developers to be using the new oAuth...

---

<div class="post-metadata">

**Author:** ![burlesque](https://avatars.discourse-cdn.com/v4/letter/b/d07c76/32.png) [@burlesque](https://discuss.dev.twitch.com/u/burlesque)\
**Post date:** [April 26, 2020, 10:28am UTC](https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191/3 "2020-04-26T10:28:40Z")

</div>

That was super fast, thanks!  
I have no server-side code, only client (android app). I’m just showing the list of active streams, no logins, nothing. What do you recommend?  
Thanks again!

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 26, 2020, 10:31am UTC](https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191/4 "2020-04-26T10:31:50Z")

</div>

Personally.

I’d have a central server, that central server would relay/internally cache the requests. (Two android users looking up /twitch being live, you can save a request to the API if you already recently fetched that data for example), then the app wouldn’t need any tokens at all.

Alternatively:

Your Android App, would implement Implicit Auth, which’ll generate a token for you (without needing a server), which would have a nicer expires\_at than a regular user token.

> **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)**
>
> Getting OAuth Access Tokens

Also means that since you know whom the person is, you can personalize a little better. (Show the users profile and/or fetch their follows and show their followed streams first or something)

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [May 26, 2020, 10:31am UTC](https://discuss.dev.twitch.com/t/oauth-for-all-helix-endpoints/25191/5 "2020-05-26T10:31:53Z")

</div>

Closed on May 26, 2020, 10:31am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.