A reminder to validate access tokens when using OAuth2

This is a really bizarre requirement from Twitch. No other OAuth provider has this requirement. If the user revokes access, the token should simply stop working. The closest I’ve seen is at Facebook where they have it lets you know when a user has revoked access.

Currently we’ve got approximately 10 million Twitch authenticated users in our platform. It’s going to be very vexing for us to run ~3000 checks per second continuously and I’m sure Twitch isn’t going to appreciate it.