# Wrong return type of scope on token endpoint

**URL:** <https://discuss.dev.twitch.com/t/wrong-return-type-of-scope-on-token-endpoint/15858>\
**Category:** API\
**Created:** [May 18, 2018, 10:34am UTC](https://discuss.dev.twitch.com/t/wrong-return-type-of-scope-on-token-endpoint/15858 "2018-05-18T10:34:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chd\_](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/chd_/32/4573_2.png) [@chd\_](https://discuss.dev.twitch.com/u/chd_)\
**Post date:** [May 18, 2018, 10:34am UTC](https://discuss.dev.twitch.com/t/wrong-return-type-of-scope-on-token-endpoint/15858/1 "2018-05-18T10:34:01Z")

</div>

Hello there,

I am experiencing an issue with the OAuth2 and especially the OIDC implementation.

The reason seems to be an invalid type of the `scope` value in the token response.

1. What is actually happening?  
After getting the `code` from a client, one will perform a POST request to the `/oauth2/token` endpoint.  
The resulting response looks like this:

2. What is documented?  
The [dev.twitch.tv](http://dev.twitch.tv) documentation [1] states, that the resulting response should look like this:

3. What should be happening?  
According to RFC6749 section 5.1 [2] first of all the implementation of the `scope` key-value is optional. It is only REQUIRED ([3]) when you actually grant more or less scopes than the user intially requested. However the value should follow the specs described in RFC6749 section 3.3 which would result in a **space-seperated** (!) value for the `scope` [3].

This issue has already been partly addressed by [4], however it has been thought to be in the wrong place (the documentation) while it actually seems to be an implementation issue.

The result of this implementation issue is a non conformity with the OAuth2 spec resulting in a non conformity with the OIDC specification and thus with some OIDC clients. I, in particular, experienced this issue with Red Hat Kleycloak.

Thanks,  
Chris

[1] [https://dev.twitch.tv/docs/authentication#oidc-authorization-code-flow-id-tokens-and-user-access-tokens](https://dev.twitch.tv/docs/authentication#oidc-authorization-code-flow-id-tokens-and-user-access-tokens)  
[2] [https://tools.ietf.org/html/rfc6749#section-5.1](https://tools.ietf.org/html/rfc6749#section-5.1)  
[3] [https://tools.ietf.org/html/rfc6749#section-3.3](https://tools.ietf.org/html/rfc6749#section-3.3)  
[4] [Docs list incorrect type for oauth "scope" field](https://discuss.dev.twitch.com/t/docs-list-incorrect-type-for-oauth-scope-field/10427)

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [June 17, 2018, 10:34am UTC](https://discuss.dev.twitch.com/t/wrong-return-type-of-scope-on-token-endpoint/15858/2 "2018-06-17T10:34:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.