Error to create a Authorization code grant flow

API
2

Step 1 of oAuth is to redirect the user to Twitch.
Not to fetch the URL

Also: ClientID’s are public. So you censored it for no reason.

oAuth steps:

  1. User comes to your website
  2. User clicks link to login with Twitch
  3. User is taken to Twitch
  4. User accepts (or declines) the link between ClientID and their account
  5. If Accept they come back to your website with a ?code
  6. You exchange the ?code for an access and refresh token

You are getting an invaldi CSRF token as the security system is preventing you trying to do this wrong.

Here is an implict auth (not code auth which you want to use) example to demonstate the flow

https://barrycarlyon.github.io/twitch_misc/authentication/implicit_auth/