# OAuth client-secret invalid after oauth\_receipt

**URL:** <https://staging-discuss.dev.twitch.com/t/oauth-client-secret-invalid-after-oauth-receipt/12734>\
**Category:** Extensions\
**Created:** [November 5, 2017, 3:44pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-client-secret-invalid-after-oauth-receipt/12734 "2017-11-05T15:44:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jordan30001](https://avatars.discourse-cdn.com/v4/letter/j/97f17d/32.png) [@jordan30001](https://staging-discuss.dev.twitch.com/u/jordan30001)\
**Post date:** [November 5, 2017, 3:44pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-client-secret-invalid-after-oauth-receipt/12734/1 "2017-11-05T15:44:04Z")

</div>

I am having issues generating an OAuth code after enabling my extension with oauth\_receipt endpoint where I keep getting invalid\_client\_secret error.

Steps taken:

1. User authorises exstension
2. Save param ‘code’ for later
3. post to [https://api.twitch.tv/extensions/](https://api.twitch.tv/extensions/)\<extension id\>/0.0.1/oauth\_receipt?channel\_id=\<channel id\>  
with header “Authorisation”: Bearer \<token\>
4. Endpoint returns 204
5. post to [https://api.twitch.tv/kraken/oauth2/token?client\_id=](https://api.twitch.tv/kraken/oauth2/token?client_id=)\<extension id\>&client\_secret=\<urlencoded secret\>&code=\<code received from 1.1\>&grant\_type=authorization\_code&redirect\_uri=\<urlencoded url\>

response

```
{
"error": "Forbidden",
"status": 403,
"message": "Invalid client secret"
}

```

The \<client secret\> that I am using is the one generated from [https://api.twitch.tv/extensions/](https://api.twitch.tv/extensions/)\<extension ID\>/auth/secret  
Which I assume is not the correct client secret I am looking for, can anyone shed some light on this?

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [November 5, 2017, 5:39pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-client-secret-invalid-after-oauth-receipt/12734/2 "2017-11-05T17:39:04Z")

</div>

The Extension dashboard doesn’t show you the Client Secret (but does the RedirectURI).

Obtain the Client Secret from: [https://dev.twitch.tv/dashboard/apps/MYEXTENSIONID/edit](https://dev.twitch.tv/dashboard/apps/MYEXTENSIONID/edit) like a Traditional App.

I raised this issue with the devs at TwitchCon so I know a ticket is in.