Once the user has installed your extension, you will need to create a link on the configuration page that will send them through your OAuth flow, and until they have done so you should restrict functionality to comply with extension guidelines (So you could still continue to display things, but anything that would require checking if the user is banned or not should be disabled until the broadcaster grants you permission).