Implicit auth:
Only requires ClientID is the most appropriate to use for local apps
Or your App phones home/logs into a server and your server holds the login/twitch account matches/key pairs
Follows are not over PubSub. that would require long polling the follows API
Only if your App can’t raise a web server to recieve the loop back (with a bit of JS to grab the acess token from the #hash and relay to your app) with the access token.