Refresh token validity

API
1

Hello,

I apologize in advance for my English, to say the least, and I’m not using Anglicisms.

I developed a bot for a friend who streams, and to do things properly, there’s a token and refresh token access for part of her application, specifically to access real-time information about the stream (donations, viewing bonuses, raids, etc.). Everything works perfectly. However, every 15 days or so, the refresh token becomes invalid.

My questions are:

  • Does a refresh token have an expiration time?

  • Can it change overnight?

When I ask my friend to give me her token and refresh token again (via a dedicated authentication page), it seems that her refresh token has indeed changed. Or perhaps I’m not using the correct method.

Thank you in advance for your help!

2

Sounds like you have used a refresh token to get a new access token, which can also return a new refresh token and you didn’t store the new refresh token.

So the refresh token you held on to expired as you never collected the new one when refreshing.

There is also the 50 token rule but I doubt that applies in the described case

This is assuming regular code flow and not Device Code Flow

3

Thank you for your reply.

So, indeed, thinking that the refresh token can be changed, I retrieve it each time. However, I make sure to retrieve and reuse it systematically. But this isn’t the case because after 15 days (which means 90 tokens refreshed at a rate of 1 token per hour), I end up getting a 400 error. For example, yesterday, the token was refreshed at 5:34 PM, as it was every 4 hours, everything went smoothly, as with the previous refreshes, and at 8:34 PM, I got “status: 400, message: ‘Invalid refresh token’”. And obviously, the entire application crashed and became useless since my token could no longer be refreshed.

I use the same method for another token, and I don’t have this problem.

For context, I use two tokens. One token allows the bot to read and write to the chat (I never have any problems with that one), and another token keeps it informed about everything happening on the channel, especially sockets and such. This token is generated by my friend’s account, which authenticates via a specific page granting permissions. That might explain why I’ve missed a crucial detail.

4

This should be part of the application they are using so you don’t have to use the page and copy over, which is what you seem to be doing here. so if/when auth dies the streamer can reauth and away you go without a barrier

I can’t think of anything obvious here.

Other than it’s working as expected here.

So could be order of operations or the caster is disconnecting your app (or chanign their password which revokes tokens/refreshes), but that feels unlikly

So feels like something in your environment.

Or the user is spam/reusing your auth page when they don’t need to and the page isn’t sending the tokens over to your app. and hitting the 50 rule…

So you need the auth better integrated with your app so if the page is used “early” you can get the new tokens without interaction of yourself

5

Thank you for your feedback.

While writing this, I realize my authentication method isn’t working correctly.

Under normal usage, it uses auth.php, which requests the following scope: user:read:email user:read:subscriptions

And when I need to, it uses auth_bot.php to refresh the refresh token, which requires:

‘channel:read:subscriptions bits:read channel:read:redemptions moderator:read:followers user:read:chat channel:read:charity’;

However, since it often uses the regular link to log in to the app, which requires Twitch authentication, this must be overwriting the refresh token, making it invalid.