You do not. I usually do myself.
Yes.You need to redirect the user to twitch in order to authenticate