# Authentication for embedded chat in iOS/Android app

**URL:** <https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323>\
**Category:** Chat and IRC\
**Created:** [April 16, 2018, 8:24am UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323 "2018-04-16T08:24:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhess](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mhess](https://staging-discuss.dev.twitch.com/u/mhess)\
**Post date:** [April 16, 2018, 8:24am UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323/1 "2018-04-16T08:24:44Z")

</div>

Not sure if this is the right venue for this, but I’m trying to build a react native app that has twitch video and chat embedded in it. The only way that I currently know how to do this is using the [embedded chat/video](https://dev.twitch.tv/docs/embed/) inside of a [WebView](https://facebook.github.io/react-native/docs/webview.html).

The issue with this approach is that in order for the user to post chat msgs, it seems like login must happen inside the WebView, and that I have no way of doing this with the app’s react native UI. Login inside a WebView would be unacceptable because I don’t have control over the UI. I thought about trying to have the user enter in their username/password inside the app, and then trying to authenticate with JS request inside the WebView, but that request requires a valid CSRF token, and I don’t know how to obtain one easily. I also don’t like the idea of storing the user’s Twitch password in my app…

Is there some way to be able to use the API credentials to authenticate for embedded chat?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2018, 9:37am UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323/2 "2018-04-16T09:37:20Z")

</div>

oAuth implicit should work for this.

> **[Apps & Authentication](https://dev.twitch.tv/docs/authentication/#oauth-implicit-code-flow-user-access-tokens)**
>
> Apps & Authentication

---

<div class="post-metadata">

**Author:** ![mhess](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@mhess](https://staging-discuss.dev.twitch.com/u/mhess)\
**Post date:** [April 16, 2018, 4:16pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323/3 "2018-04-16T16:16:23Z")

</div>

Thanks for the response. All the documentation I’ve read shows how to use oauth tokens in requests to the API, but not to non-API endpoints (e.g. the URL for chat embedding). Do you know how I would present that token for such a request?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2018, 4:41pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323/4 "2018-04-16T16:41:43Z")

</div>

> [@mhess](#):
>
> Do you know how I would present that token for such a request?

Ah, you can’t!

The docs for embedding chat are here:

> **[Embedding Twitch](https://dev.twitch.tv/docs/embed/#embedding-chat)**
>
> Embedding Twitch in Your Website

And basically YOU personally cannot (and should not) handle the authentication.

The iframe will present the relevant forms for users to login with.

You could use a `chat_login` scope and build a custom chat for send/receive chat over websocket, but I wouldn’t suggest that for your usecase

---

<div class="post-metadata">

**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\
**Post date:** [May 16, 2018, 4:41pm UTC](https://staging-discuss.dev.twitch.com/t/authentication-for-embedded-chat-in-ios-android-app/15323/5 "2018-05-16T16:41:59Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.