Error 429 - Limitation ? (Helix API)

The OAuth process is completely separate from requests to the API endpoint.

If you want to use the Auth Code flow, you would follow the instructions here: https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-authorization-code-flow which will send the user to Twitch, if the accept connecting to your app they’ll be redirected back to your website with a code as a querystring param, which your server can then exchange for an Access Token.

Once you’ve got that Access Token you can make requests by using the Authorization: Bearer <Token> header.

Those requests MUST be done server-side as you must not expose your client secret to the client. If you wish to do API requests client side you should use the Implicit Auth Flow https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-implicit-code-flow where the user is redirected back to your website with a User Access Token in the url hash, which the frontend can use as the Authorization header in the same way I previously mentioned.

If you want to do it entirely server-side, you can use an App Access Token https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-client-credentials-flow which doesn’t require user interaction, or redirecting them at all, but the requests can only be done on your server as you can’t expose that token to the user.

1 Like