We support the state OAuth2 parameter, which is strongly recommended for avoid cross-site scripting attacks. If included, it is appended to the list of query parameters when redirecting the user to the redirect_uri.
The parameter force_verify can also be appended to this URL. This parameter decides whether the user should be re-prompted for authorization. The default is false, so a given user will only see the authorization page for a given set of scopes the first time through the sequence. If set to true, the user will always be prompted to confirm authorization. This is useful for allowing your users to switch Twitch accounts, since there is not a way to log users out of the API.
So the above suggests that the state is a oauth token, however, you haven’t yet been provided with a authed user token. So - Who’s oauth token DO you have access to? 