@Pixel That’s an exercise for you to figure out and not something prescriptive from the Twitch API. I would recommend reading up on OAuth 2 and CSRF. There are a lot of articles covering state and how to implement it properly. It’s a security concern. If you’re interested in standards, you can read about state here: https://tools.ietf.org/html/rfc6749#section-10.12