401: Missing User OAUTH Token (get-custom-rewards)

[TheKill_996]

@BarryCarlyon

Correct, to utilise the API on behalf of a broadcaster you need permission from the data owner, in this case the broadcaster.

The streamer “owns” the rewards and redemptions.

What if I wanted to access the API as the broadcaster and not on behalf of him? Like can I access my data without asking myself the permission? I don’t know if that makes sense.

@BarryCarlyon

You authenticate/get a token from the streamer once.

This gives you a user token and a refresh token.
When the user token expires, you use the refresh token to get a new token.

if the refresh token dies or becomes invalid, you will need to get the broadcaster to reauthenticate

See this oAuth flow: Getting Tokens: OAuth | Twitch Developers

Great, when the APIs return error 401 I usually ask for a new token to Twitch and re-do the requests. I’m not 100% sure that error 401 get raised only when the token is expired, but it always worked since now.

@BarryCarlyon

Yes, you run a server hosting your Auth service to get a token from the user. Then you can act as the user.

That’s seems to be my main problem: I don’t own a server to create the Aouth service. Do you know any public online service that can help me doing that? Can’t I just share the link with the broadcaster and he returns me the URL he gots after sign in? Basically, any method without owning a server?

@BarryCarlyon

Sure you could go the implicit route and have the user copy/paste the token somewhere, but this sort of token cannot be refreshed.

Obviously this kind of token will expire and I will need to ask the broadcast to get another one for me, so not doable. It will be great if it doesn’t expire, but it does, right?

@BarryCarlyon

If I’m building a widget/overlay I don’t use SE. I use all my own stuff.

I see your point, but I’m not doing this for my self. Most of the people don’t run their own service because they’re not able to mantain it: that why services like SE went viral.

@BarryCarlyon

So you cripple yourself and deny your self access to Twitch PubSub and EventSub, if you can only make Get/Post requests.

Actually there are examples of people using PubSub on SE too, here you got an example, I wanted to take this an example for retrieving Redemptions in real time through SE systems.