Change title and description

BarryCarlyon · March 20, 2021, 9:25pm

The code is not a token

See Step 3

In our example, your user gets redirected to:

http://localhost/?code=394a8bc98028f39660e53025de824134fb46313
    &scope=viewing_activity_read
    &state=c3ab8aa609ea11e793ae92361f002671
3) On your server, get an access token by making this request:

POST https://id.twitch.tv/oauth2/token
    ?client_id=<your client ID>
    &client_secret=<your client secret>
    &code=<authorization code received above>
    &grant_type=authorization_code
    &redirect_uri=<your registered redirect URI>

or for PHP example:

github.com

BarryCarlyon/twitch_misc/blob/main/authentication/user_access_generator/php/index.php#L32


      
          
                  // note: not testing the HTTP response codes,
                  // since we don't care too much as logging out
                  curl_close($ch);
              }
          
              session_destroy();
              header('Location: /');
          
              exit;
          } else if (isset($_GET['code']) && $_GET['code']) {
              // we have a code on the address line so lets parse and exchange
          
              // validate the state/nonce
              if (isset($_SESSION['nonce']) && isset($_GET['state']) && $_SESSION['nonce'] == $_GET['state']) {
                  // lets exchange the code for an access token
                  $ch = curl_init('https://id.twitch.tv/oauth2/token');
                  curl_setopt($ch, CURLOPT_POST, true);
                  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                  curl_setopt($ch, CURLOPT_POSTFIELDS, array(
                      'client_id' => CLIENT_ID,