Manage more one access_token for unique user and application

[BarryCarlyon]

@Sylvanus

Do I have the right to use several access_token in parallel for the same user, same scope and same application?

Sure, but in practice that is a bad idea.

Additionally if you are using multiple tokens for the same user, with commands being issued from the same server, that can be seen as an attempt to circumvent rate limiting, which you are not allowed to do.

@Sylvanus

I notice that if I go through the authentication process several times, I get different access_token and refresh_token all the time. I do not have the impression that obtaining a new access_token invalidates the old nor the old refresh_token. So I can thus completely independently use and renew each of the keys obtained in this way?

Each new auth loop (redirect to Twitch, user accepts and comes back to your callback) will generate a new token.

But there is a limit on the number of tokens you can have active for a given client ID/userID pair, so if you generate enough in this way, the oldest tokens (and refreshes) will just stop working.

Generally speaking you send the user via the oAuth loop, and store it in a database with a unique key for userID/scopes on the token, in case you need to run two keys with different scopes, but again if you generate enough keys the oldest keys will get murdered. So in reality you should manage a single key for a user, and lump all the scopes you need onto one key.