Long-Lived Desktop Chat Application OAuth Token Secure Storage

[BarryCarlyon]

@TinaTiel

unless there’s docs somewhere on invalidating an existing token

Revoke is documented here:

Authentication

@TinaTiel

if I validate the token at https://id.twitch.tv/oauth2/validate then both my old and new token are still valid; I don’t get 401 unauthorized

Twitch will let a given client generate either 25 or 50 (I forget which offhand) Tokens per user.

So when you make the 26th it will kill the first token for sure (by age).

Otherwise yeah, Twitch lets you have more than one active token. Since a given token could have a different group of scopes applied to it so.

So you could have

• token a with chat scopes only
• token b with just “subscriber read” scopes
  etc and so forth

@TinaTiel

Thanks so much for your discussion like this, on a Sunday especially!

No problem at all!

Also as a side note, I like to do “alternative auth” in the desktop app, and then my app uses a socket with my server, and then my server does all the grunt work of getting all the data into one feed to send to the app. 'course this use case will vary depending on what you app does. but just a side note that occured to me!