# Oauth token, return 401 error

**URL:** <https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364>\
**Category:** API\
**Created:** [October 9, 2017, 11:49am UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364 "2017-10-09T11:49:05Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Athreem](https://avatars.discourse-cdn.com/v4/letter/a/7993a0/32.png) [@Athreem](https://discuss.dev.twitch.com/u/Athreem)\
**Post date:** [October 9, 2017, 11:49am UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/1 "2017-10-09T11:49:05Z")

</div>

GET OAUTH  
`https://api.twitch.tv/kraken/oauth2/authorize?client_id=CLIENTID&redirect_uri=http://mysite.ru/auth/&response_type=code&scope=user_read+channel_subscriptions&state=c3ab8aa609ea11e793ae92361f002671'`

[https://api.twitch.tv/kraken/?oauth\_token=](https://api.twitch.tv/kraken/?oauth_token=) | **return true oauth code**

CODE:  
$ch = curl\_init();  
curl\_setopt($ch,CURLOPT\_URL, “[https://api.twitch.tv/kraken/channel](https://api.twitch.tv/kraken/channel)”);  
curl\_setopt($ch, CURLOPT\_HTTPHEADER, array('Authorization: OAuth '.$code));  
curl\_setopt($ch, CURLOPT\_HTTPHEADER, array( ‘Accept: application/vnd.twitchtv.v5+json’));  
curl\_setopt($ch, CURLOPT\_HTTPHEADER, array( ‘Content-Type: application/json’));  
curl\_setopt($ch, CURLOPT\_HTTPHEADER, array( 'Client-ID: '.$clientid));  
$response = curl\_exec($ch);  
curl\_close($ch);  
echo $response;

My code return error  
`{"error":"Unauthorized","status":401,"message":"authentication failed"}`

If you make a transition directly from a browser then all works  
[https://api.twitch.tv/kraken/channel?client\_id=".$clientid."&oauth\_token=](https://api.twitch.tv/kraken/channel?client_id=%22.%24clientid.%22&oauth_token=)".$code

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [October 9, 2017, 11:51am UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/2 "2017-10-09T11:51:49Z")

</div>

After doing the authorize call, you are returned to your server.

You must then take the code passed and exchange to code for a token.

Then you must use the token as OAuth in the requests.

Further more your PHP is wrong try this:

```
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Authorization: OAuth '.$code,
    ‘Accept: application/vnd.twitchtv.v5+json’,
    ‘Content-Type: application/json’,
    'Client-ID: '.$clientid
));

```

You were only setting ONE header containing the clientID. The first three are overwritten

---

<div class="post-metadata">

**Author:** ![Athreem](https://avatars.discourse-cdn.com/v4/letter/a/7993a0/32.png) [@Athreem](https://discuss.dev.twitch.com/u/Athreem)\
**Post date:** [October 9, 2017, 12:36pm UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/3 "2017-10-09T12:36:56Z")

</div>

> [@BarryCarlyon](#):
>
> You must then take the code passed and exchange to code for a token.

But I’m getting a token already, and it work when used from a browser

If I try in the address bar to pass the clientid and oauth, I get the response from twitch

> [@BarryCarlyon](#):
>
> You must then take the code passed and exchange to code for a token.

okay, need use it? [https://api.twitch.tv/kraken/oauth2/token](https://api.twitch.tv/kraken/oauth2/token)  
?client\_id=  
&client\_secret=  
&code=  
&grant\_type=authorization\_code  
&redirect\_uri=

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [October 9, 2017, 1:01pm UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/4 "2017-10-09T13:01:54Z")

</div>

> [@Athreem](#):
>
> But I’m getting a token already, and it work when used from a browser

You didn’t include this step in your code, so I reiterated it.

The problem is your PHP code not sending headers correctly.

See my corrective code

---

<div class="post-metadata">

**Author:** ![Athreem](https://avatars.discourse-cdn.com/v4/letter/a/7993a0/32.png) [@Athreem](https://discuss.dev.twitch.com/u/Athreem)\
**Post date:** [October 9, 2017, 1:11pm UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/5 "2017-10-09T13:11:52Z")

</div>

> [@BarryCarlyon](#):
>
> You didn’t include this step in your code, so I reiterated it.
> 
> The problem is your PHP code not sending headers correctly.
> 
> See my corrective code

Thanks, i change code  
$ch = curl\_init();  
curl\_setopt($ch,CURLOPT\_URL, “[https://api.twitch.tv/kraken/channel](https://api.twitch.tv/kraken/channel)”);  
curl\_setopt($ch,CURLOPT\_CERTINFO, 1);  
curl\_setopt($ch, CURLOPT\_HTTPHEADER, array(  
'Authorization: OAuth '.$code,  
‘Accept: application/vnd.twitchtv.v5+json’,  
‘Content-Type: application/json’,  
'Client-ID: '.$clientid  
));  
$response = curl\_exec($ch);  
curl\_close($ch);

Returns an error  
{“error”:“Unauthorized”,“status”:401,“message”:“authentication failed”}

But if you go to the direct link I get the answer  
“[https://api.twitch.tv/kraken/channel?client\_id=“.$clientid.”&oauth\_token=](https://api.twitch.tv/kraken/channel?client_id=%22.$clientid.%22&oauth_token=)”.$code

I get the code for php  
**OAuth Authorization Code Flow**  
‘[https://api.twitch.tv/kraken/oauth2/authorize?client\_id=“.$clientid.”&redirect\_uri=http://mysite.ru/auth/&response\_type=code&scope=user\_read+channel\_subscriptions&state=c3ab8aa609ea11e793ae92361f002671](https://api.twitch.tv/kraken/oauth2/authorize?client_id=%22.$clientid.%22&redirect_uri=http://mysite.ru/auth/&response_type=code&scope=user_read+channel_subscriptions&state=c3ab8aa609ea11e793ae92361f002671)’;

---

<div class="post-metadata">

**Author:** ![3ventic](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/3ventic/32/298_2.png) [@3ventic](https://discuss.dev.twitch.com/u/3ventic)\
**Post date:** [October 9, 2017, 2:13pm UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/6 "2017-10-09T14:13:50Z")

</div>

/kraken/channel needs **channel\_read** , not user\_read.

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [November 8, 2017, 2:19pm UTC](https://discuss.dev.twitch.com/t/oauth-token-return-401-error/12364/7 "2017-11-08T14:19:01Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.