Twitch Device Code Grant issues valid code, but activation rejects it before consent

API
1

Hello Twitch Developer Support,

We are seeing a reproducible Twitch Device Code Grant issue in a credential-governed, read-only bot integration. Device-code issuance succeeds, but the Twitch activation page rejects the freshly issued code as “Incorrect code” before any consent screen appears.

Application details (non-secret):

  • Application: PALADIN Guard Sandbox VFG
  • Client ID: qvljn1hrhc373m3qe4asgq5c31h9cu
  • Application owner/account: PALADIN_Guard_Bot
  • Category: Chat Bot
  • Client type: Confidential
  • Registered redirect URL: https://localhost:3000
  • Requested scopes: user:bot user:read:chat

Clean reproduction:

  1. Requested one fresh device code from Twitch.
  2. Twitch returned HTTP 200 with a 1,800-second expiry and a 5-second polling interval.
  3. Opened the exact provider-returned verification URI.
  4. Confirmed the displayed entry matched the fresh code exactly, with no extra characters and no pre-existing error.
  5. Confirmed the signed-in account was PALADIN_Guard_Bot.
  6. Submitted Activate exactly once.
  7. The page returned “Incorrect code” before displaying consent.

UTC timestamps:

  • Device code issued: 2026-09-03 12:14:28Z
  • Verification page checked: 2026-09-03 12:14:45Z
  • Single Activate submission: 2026-09-03 12:18:21.841Z
  • Rejection displayed: 2026-09-03 12:18:23.612Z

The device code had not expired. We performed no token polling or token exchange during this diagnostic, and no credential was created, stored, or changed. Earlier attempts affected by a malformed URL were excluded from this reproduction.

The provider-returned verification URI did not include a public=true query parameter. Twitch documentation states that Device Code Grant supports public and confidential clients. Could Twitch staff confirm whether confidential Chat Bot applications require additional configuration or a different activation flow, or whether this is an activation-side issue?

For security, this report intentionally excludes all device codes, user codes, access or refresh tokens, client secrets, authorization headers, cookies, host details, and private logs.

Thank you.

2

I plugged this client ID into my example/test found here twitch_misc/authentication/electron_devicecode at main · BarryCarlyon/twitch_misc · GitHub and was unable to replicate.

This suggest an environmental issue or a fault with the browser being used to complete the auth steps

From settings/connections can see I connected find

image