# User Access Token Vs App Access Tokens. I'm confused **URL:** \ **Category:** API\ **Created:** [January 16, 2018, 9:37pm UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789 "2018-01-16T21:37:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Azazael13](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@Azazael13](https://discuss.dev.twitch.com/u/Azazael13)\ **Post date:** [January 16, 2018, 9:37pm UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/1 "2018-01-16T21:37:18Z")
I am hoping someone can help me understand the differences in these. I am going to try to be verbose just so my process is clear. I currently have a bot that is using OAuth2 authentication. My users will go to the bots website and login using twitch. The initial call looks like this authorize?response\_type=code&client\_id=IDHERE&redirect\_uri=URIHERE&scope=SCOPEHERE After that call I take the code I get and make another call with my client ID, secret, and grant type of authorization code. I use the return from that to get the access\_token and refresh\_token. After that I use the access\_token to check their information and move along. I store the access\_token but don’t ever use it again. All of that would be the User Access Token correct? Inside of my bot I am doing things like checking to see who is online, their followers, their subs, and follow dates. Within those calls to the V5 API I am just using my Client ID. I want to start adding some of the new functionality like creating clips. Is this where I would use app access tokens (obtained by the OAuth Client Credentials Flow (App Access Tokens))? Would I then use that access token for calls, and not the user access tokens I got earlier? I tried searching around a little bit but didn’t see anything that really cleared it up for me. ---
**Author:** ![TheElm](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/theelm/32/2911_2.png) [@TheElm](https://discuss.dev.twitch.com/u/TheElm)\ **Post date:** [January 16, 2018, 9:49pm UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/2 "2018-01-16T21:49:59Z")
The difference between the `User Access Token` and the `App Access Token` is stated in the “Types of Tokens” section of the OAuth documentations [https://dev.twitch.tv/docs/authentication#types-of-tokens](https://dev.twitch.tv/docs/authentication#types-of-tokens) It states that `... app access tokens are not associated with a user, they cannot be used with endpoints that require user authentication` Thus meaning that an application access token cannot be used to view private information such as Subscribers. App and User access tokens both function the same way. The Twitch API requires _you_ (the developer) to provide an authorization to access it. The `User Access Token` is the _user_ granting _you_ permission to view their information. If your application wanted to view _public_ information such as **games** or **streams** you need to have permission from Twitch via an `Application Access Token` If your application wanted to view _private_ information such as **subscribers** or the **stream key** you need to go through the OAuth Client Credentials Flow (As you were doing to receive the stored access\_token), and use that access\_token as authentication. P.S. Store the refresh\_token too, you need it to get a new access\_token when it expires **Edit:** Just another thing to note, if you’re retrieving a `User Access Token` you might not need an `App Access Token` at all. When fetching a users stream (even though it’s public information) you can still use the Users Access Token. User Access Token can view _Public_ **and** _Private_ Information. App Access Token can _only_ view Public Information ---
**Author:** ![Azazael13](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@Azazael13](https://discuss.dev.twitch.com/u/Azazael13)\ **Post date:** [January 16, 2018, 9:58pm UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/3 "2018-01-16T21:58:32Z")
I had looked through the doc, I just couldn’t wrap my head around it. When you put it that way it makes more sense. Do the different endpoints say which token they need? I.E. does clip create just need app, where subs would need user? I knew I would need the refresh token at some point, but up until now I hadn’t needed it (I just started working with subs, everything else I did didn’t need tokens). ---
**Author:** ![TheElm](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/theelm/32/2911_2.png) [@TheElm](https://discuss.dev.twitch.com/u/TheElm)\ **Post date:** [January 16, 2018, 10:04pm UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/4 "2018-01-16T22:04:58Z")
I appended an edit to my original response. If you have a User Access Token you can use that for _every_ endpoint. (As long as the key remains valid; a user can choose to deactivate a granted access token in [https://www.twitch.tv/settings/connections](https://www.twitch.tv/settings/connections) (Make sure to catch invalid responses if a user invalidates their token) ) As for endpoints where you _can’t_ use an Application Access Token, endpoints will list a **Required scope:** such as `channel_subscriptions` in APIv5 subscribers [https://dev.twitch.tv/docs/v5/reference/channels#get-channel-subscribers](https://dev.twitch.tv/docs/v5/reference/channels#get-channel-subscribers) These require the User Access Token with the listed scope. ---
**Author:** ![george](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/george/32/120_2.png) [@george](https://discuss.dev.twitch.com/u/george)\ **Post date:** [January 17, 2018, 12:04am UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/5 "2018-01-17T00:04:49Z")
Create clips needs a user access token since you are creating a clip on behalf of a user. Same with subscribers. App access tokens have no use in the Kraken API. In Helix you can use them for increased rate limits and they are also needed for Drops (which is limited to game developers). ---
**Author:** ![Azazael13](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@Azazael13](https://discuss.dev.twitch.com/u/Azazael13)\ **Post date:** [January 17, 2018, 1:19am UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/6 "2018-01-17T01:19:27Z")
Final question. I think I read this in another topic, but the OAuth2 process I am using now (with Kraken) isn’t changing with the new API, so if I have working OAuth2 now, I will be fine. (I thought I read the auth system was different from the rest of the API) Thank you very much for the help TheElm ---
**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\ **Post date:** [February 16, 2018, 1:19am UTC](https://discuss.dev.twitch.com/t/user-access-token-vs-app-access-tokens-im-confused/13789/7 "2018-02-16T01:19:43Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.