# OAuth sanity check **URL:** \ **Category:** Chat and IRC\ **Created:** [October 20, 2018, 6:56am UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320 "2018-10-20T06:56:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![deef0000dragon1](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/deef0000dragon1/32/11991_2.png) [@deef0000dragon1](https://staging-discuss.dev.twitch.com/u/deef0000dragon1)\ **Post date:** [October 20, 2018, 6:56am UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/1 "2018-10-20T06:56:31Z")
I need a sanity check. I have been working on my site, which uses twitch for logins. Part of the site is also supposed to be able to chat as a logged in user. I can log into the site using the login url that I have > [https://id.twitch.tv/oauth2/authorize?response\_type=code&client\_id=\](https://id.twitch.tv/oauth2/authorize?response_type=code&client_id=%5C)&redirect\_uri=\&scope=openid+bits:read+clips:edit+user:edit:broadcast+user:read:broadcast+user:read:email+channel\_check\_subscription+channel\_commercial+channel\_editor+channel\_read+channel\_subscriptions+collections\_edit+chat:edit+user\_read+user\_subscriptions+viewing\_activity\_read (I am aware that I am asking for a lot of scopes. Working on that. ) Considering that, as I have chat:edit, I SHOULD be able to chat as that user yes? Do I have to use the implicit auth flow somewhere as well? Any time that I try to chat using oauth:\ that I get from twitch, the code I want to use to chat doesn’t work, but using a code from [Twitch Chat Password Generator](https://twitchapps.com/tmi/) (which uses the implicit) works. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [October 20, 2018, 8:09am UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/2 "2018-10-20T08:09:52Z")
As per the scopes documented here > **[Authentication](https://dev.twitch.tv/docs/authentication/#scopes)** > > Authentication `chat:edit` is correct, for sending. But that is way way way too many scopes… What are you building a competitor to the Twitch Dashboard 😛 In addition, you might want to look at just embedded chat instead of going oAuth. As documented: > **[Chat](https://dev.twitch.tv/docs/embed/chat/)** > > Embedding Chat You probably don’t need the chat oAuth scopes at all. ---
**Author:** ![deef0000dragon1](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/deef0000dragon1/32/11991_2.png) [@deef0000dragon1](https://staging-discuss.dev.twitch.com/u/deef0000dragon1)\ **Post date:** [October 20, 2018, 6:58pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/3 "2018-10-20T18:58:07Z")
Thanks for the sanity check. as for the what am I doing, I am attempting to build a “program your own bot” site. Respond to many different inputs and use many different outputs. from chatting in the channel, to changing the title. Example: Mod drops a strawpoll in the chat. The bot picks it up, reposts it every so often, and after a period of time, announces the winner. The title and or game is then changed to reflect the results. I originally looked at the list and added what I wanted to eventually add (bit off more than I could chew), but for now I am going to trim it down and just trey to get what I can working, then add as I build up. ---
**Author:** ![Doobie](https://avatars.discourse-cdn.com/v4/letter/d/ed655f/32.png) [@Doobie](https://staging-discuss.dev.twitch.com/u/Doobie)\ **Post date:** [October 20, 2018, 8:42pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/4 "2018-10-20T20:42:35Z")
Keep in mind it looks like you are using the old way of authenticating. V5 API is now deprecated. ---
**Author:** ![deef0000dragon1](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/deef0000dragon1/32/11991_2.png) [@deef0000dragon1](https://staging-discuss.dev.twitch.com/u/deef0000dragon1)\ **Post date:** [October 20, 2018, 8:49pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/5 "2018-10-20T20:49:19Z")
Looking at the API, it doesent appear as if the new API has anything like the openid from the V5. What do I use instead? Do I just go with something like chat:edit and assume that, because I have edit permissions, it is a logged in user? It makes logical sense, but it feels less secure than specifying openid. ---
**Author:** ![deef0000dragon1](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/deef0000dragon1/32/11991_2.png) [@deef0000dragon1](https://staging-discuss.dev.twitch.com/u/deef0000dragon1)\ **Post date:** [October 20, 2018, 9:34pm UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/6 "2018-10-20T21:34:17Z")
so, after some digging, I literally just took what [twitchapps.com](http://twitchapps.com) did for scopes (minus the deprecated one) and added them to mine after removing currently unimplemented scopes. Current scopes “scope=openid+user:read:email+chat:read+chat:edit+channel:moderate”. I am now able to use the key that I get from twitch to chat in chat. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [October 21, 2018, 9:22am UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/7 "2018-10-21T09:22:25Z")
> [@Doobie](#): > > Keep in mind it looks like you are using the old way of authenticating. V5 API is now deprecated. No he’s just used some scopes for v3/v5 which isn’t going away anytime soon as the Kraken removal date is no more. > [@deef0000dragon1](#): > > Looking at the API, it doesent appear as if the new API has anything like the openid from the V5. OpenID is an authentication method, it belongs to neither v3, v5 or helix. > [@deef0000dragon1](#): > > so, after some digging, I literally just took what [twitchapps.com](http://twitchapps.com) did for scopes (minus the deprecated one) and added them to mine after removing currently unimplemented scopes. Current scopes > “scope=openid+user:read:email+chat:read+chat:edit+channel:moderate”. I am now able to use the key that I get from twitch to chat in chat. Thats why I liked to the scopes list here > **[Authentication](https://dev.twitch.tv/docs/authentication/#scopes)** > > Authentication So you can pick and choose more succiently ---
**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\ **Post date:** [November 20, 2018, 9:22am UTC](https://staging-discuss.dev.twitch.com/t/oauth-sanity-check/18320/8 "2018-11-20T09:22:25Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.