# Authentication for a chatbot **URL:** \ **Category:** API\ **Created:** [December 30, 2020, 2:51pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705 "2020-12-30T14:51:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![JanDevDE](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/jandevde/32/11082_2.png) [@JanDevDE](https://staging-discuss.dev.twitch.com/u/JanDevDE)\ **Post date:** [December 30, 2020, 2:51pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/1 "2020-12-30T14:51:27Z")
Hey there, I’m currently writing a bot that needs to write messages to the twitch chat. I currently use a twitch OAuth generator website which utilizes the implicit OAuth flow to generate a token for my bot. I did not know yet that it expires after 60 days. How would I go about automatically getting a new token from twitch with my java app? (I cannot use the implicit code flow because hash parameters cannot be read server-side.) The only option I know would be using the code flow once manually and then automatically from within the application but that code would only be valid for 4 hours. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [December 30, 2020, 2:55pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/2 "2020-12-30T14:55:07Z")
Create a webpage that implments the “OAuth Authorization Code” flow with the scopes you need. This can even run off localhost > **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/)** > > Getting OAuth Access Tokens This will generate a token and refresh token. So when the token dies you can generate a new token automatically. Refresh is documented here: > **[Authentication](https://dev.twitch.tv/docs/authentication/)** > > Authentication You’ll need to use your website, once and then whenever the refresh token dies completely. And the “initial” token fetching will always be manual. But refreshing a token is automatic, as long as the refresh is still valid It’s worth noting, that that bots chat login token only needs to be valid when you login, so my bots will auto refresh the token at bot start/restart and uses an app access token for other API requests. ---
**Author:** ![JanDevDE](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/jandevde/32/11082_2.png) [@JanDevDE](https://staging-discuss.dev.twitch.com/u/JanDevDE)\ **Post date:** [December 30, 2020, 2:57pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/3 "2020-12-30T14:57:05Z")
So I’m just saving the refresh token and on restart of my application I’m using that to login again. Sounds good. When does the refresh token die completely though? ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [December 30, 2020, 2:58pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/4 "2020-12-30T14:58:59Z")
> [@JanDevDE](#): > > So I’m just saving the refresh token and on restart of my application I’m using that to login again. Sounds good. For clarity you use the refresh token to generate a new access token. > [@JanDevDE](#): > > When does the refresh token die completely though? Generally speaking, Twitch refresh tokens do not have an expiry. But there are a number of criteria that could invalidate a set of tokens. Such as a password reset, or generating too many seperate access tokens for the userID/clientID keypair. The latter is unlikely, but this is just the things we know of that can nail a set of keys totally. ---
**Author:** ![JanDevDE](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/jandevde/32/11082_2.png) [@JanDevDE](https://staging-discuss.dev.twitch.com/u/JanDevDE)\ **Post date:** [December 30, 2020, 3:02pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/5 "2020-12-30T15:02:27Z")
> [@BarryCarlyon](#): > > For clarity you use the refresh token to generate a new access token. That’s what I meant, yea. > [@BarryCarlyon](#): > > But there are a number of criteria that could invalidate a set of tokens. Such as a password reset, or generating too many seperate access tokens for the userID/clientID keypair. Well, I cannot think of a way to programmatically resolve this issue. Maybe I’m just setting up a phone alarm that gets sent if the token is not refreshable ^^. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [December 30, 2020, 3:03pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/6 "2020-12-30T15:03:25Z")
> [@JanDevDE](#): > > Maybe I’m just setting up a phone alarm that gets sent if the token is not refreshable ^^. Yeah I have some sort of alert system setup for that. It’s super rare. And it’s not like your bot will need to restart/reconnect that often anyway ---
**Author:** ![JanDevDE](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/jandevde/32/11082_2.png) [@JanDevDE](https://staging-discuss.dev.twitch.com/u/JanDevDE)\ **Post date:** [December 30, 2020, 3:05pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/7 "2020-12-30T15:05:41Z")
> [@BarryCarlyon](#): > > Yeah I have some sort of alert system setup for that. It’s super rare. And it’s not like your bot will need to restart/reconnect that often anyway True. Well, thanks for the fast and good reply! ---
**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\ **Post date:** [January 29, 2021, 3:05pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-a-chatbot/29705/8 "2021-01-29T15:05:42Z")
Closed on January 29, 2021, 3:05pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.