# EventSub: "subscription missing proper authorization" **URL:** \ **Category:** API\ **Created:** [November 19, 2020, 5:12pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166 "2020-11-19T17:12:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![nesttle](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nesttle/32/10719_2.png) [@nesttle](https://staging-discuss.dev.twitch.com/u/nesttle)\ **Post date:** [November 19, 2020, 5:12pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/1 "2020-11-19T17:12:54Z")
Request: `curl -X POST https://api.twitch.tv/helix/eventsub/subscriptions -H 'Authorization: Bearer ' -H 'Client-ID: ' -H 'Content-Type: application/json' -d '{"type": "channel.channel_points_custom_reward_redemption.add", "version":"1", "condition":{"broadcaster_user_id":""}, "transport":{"method":"webhook", "callback":"https://mydomain.com/channelpoints/callback.php?test=test", "secret": ""}}'` Response: `{"error":"Forbidden","status":403,"message":"subscription missing proper authorization"}` I’m getting the App access token with: `curl --data "client_id=&client_secret=&grant_type=client_credentials&scope=channel:read:redemptions+channel:moderate" https://id.twitch.tv/oauth2/token` ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [November 19, 2020, 5:16pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/2 "2020-11-19T17:16:03Z")
The channel you are trying to subscribe to has not granted your ClientID access to the relevant scopes for channel points > [@nesttle](#): > > I’m getting the App access token with: > `curl --data "client_id=&client_secret=&grant_type=client_credentials&scope=channel:read:redemptions+channel:moderate" https://id.twitch.tv/oauth2/token` Basically a `client_credentials` can’t have scopes (or a userID) You need to generate a user access token with the scopes on. So you can call the API with that token. Once that has been done, then you can use your app access token to create the subscription. So 1. Get permission from the broadcaster to read/write channel points, user access token (with scopes) 2. Then EventSub to those topics with your App Access Token (no scopes) So you need two different tokens. ---
**Author:** ![nesttle](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nesttle/32/10719_2.png) [@nesttle](https://staging-discuss.dev.twitch.com/u/nesttle)\ **Post date:** [November 19, 2020, 5:21pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/3 "2020-11-19T17:21:05Z")
Which token should I use to subscribe? user token or app token? `curl -X POST https://api.twitch.tv/helix/eventsub/subscriptions -H 'Authorization: Bearer ' -H 'Client-ID: ' -H 'Content-Type: application/json' -d '{"type": "channel.channel_points_custom_reward_redemption.add", "version":"1", "condition":{"broadcaster_user_id":""}, "transport":{"method":"webhook", "callback":"https://mydomain.com/channelpoints/callback.php?test=test", "secret": ""}}'` Having to use two tokens as you comment, I get a bit lost as the POST call only accepts one token at a time and I don’t know which one I should use. Thanks for the answer, I will read it more times to see if I clarify myself. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [November 19, 2020, 5:21pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/4 "2020-11-19T17:21:28Z")
EventSub subscriptions are _only_ created using an App Access Token You just _need_ to have created a user access token _once_ you don’t even need to store it EventSub checks if your clientID has had access to the resource you request. So you don’t need _any_ user active access tokens on file (since a user token only lives for four hours anyway) ---
**Author:** ![nesttle](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/nesttle/32/10719_2.png) [@nesttle](https://staging-discuss.dev.twitch.com/u/nesttle)\ **Post date:** [November 19, 2020, 5:22pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/5 "2020-11-19T17:22:37Z")
In that case, the Creator / streamer user access token shouldn’t be stored for later use, it just needs to be authorized and that’s it? ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [November 19, 2020, 5:23pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/6 "2020-11-19T17:23:07Z")
> [@nesttle](#): > > it just needs to be authorized and that’s it? Correct. Unless you need to read/write from Helix. Helix will need you to use the User Access Token ---
**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\ **Post date:** [December 19, 2020, 5:23pm UTC](https://staging-discuss.dev.twitch.com/t/eventsub-subscription-missing-proper-authorization/29166/7 "2020-12-19T17:23:14Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.