# OAuth2 "Stay Logged In", etc

**URL:** <https://staging-discuss.dev.twitch.com/t/oauth2-stay-logged-in-etc/3059>\
**Category:** API\
**Created:** [August 16, 2015, 10:13pm UTC](https://staging-discuss.dev.twitch.com/t/oauth2-stay-logged-in-etc/3059 "2015-08-16T22:13:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![HerrAusragend](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/herrausragend/32/4155_2.png) [@HerrAusragend](https://staging-discuss.dev.twitch.com/u/HerrAusragend)\
**Post date:** [August 16, 2015, 10:13pm UTC](https://staging-discuss.dev.twitch.com/t/oauth2-stay-logged-in-etc/3059/1 "2015-08-16T22:13:42Z")

</div>

I nearly finished my new service and I am trying to enhance the UX by giving the chance to Sign Up with Twitch, Google+, Facebook, etc.

The Authentication (obtaining access token and getting email address, etc.) is already finished, but I have never used OAuth2 that deep, so I am having some questions:

**How should I handle the “Sign In With Twitch” action?**  
I thought of just obtaining the users Email and save this to my DB.

**What should I save in myDB?**  
Which data should I save to the new user document in my DB?

- access\_token (which expires) _(=\> only need It once a time when the app requests the users email…)_
- refresh\_token
- Twitch User ID?

**How can a User re-login with the Twitch Account?**  
What is the best way to let a user login a second time?  
Do I have to request a new access token via `https://api.twitch.tv/kraken/oauth2/authorize` ?

**What is the best way to let the user stay signed in?**  
Should I set an expiration date after a User signed up with Twitch?  
Which data can be stored client-side in Cookies? My own generated UserId as every User _(who singed up the “normal” way with Email/Password)_?  
How can I check if a User did not manipulate hiw client-side data?

I would be really thankful if somebody could give me a bnuch of answers to my questions!

---

<div class="post-metadata">

**Author:** ![DatBrick](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@DatBrick](https://staging-discuss.dev.twitch.com/u/DatBrick)\
**Post date:** [September 11, 2015, 8:16pm UTC](https://staging-discuss.dev.twitch.com/t/oauth2-stay-logged-in-etc/3059/2 "2015-09-11T20:16:04Z")

</div>

so when you use the access token, and are given a code, that code is valid until they use the app on a different device where it has to re-authenticate. if that is the case, use the refresh token with [https://github.com/justintv/Twitch-API/wiki/Password-Credentials-Grant](https://github.com/justintv/Twitch-API/wiki/Password-Credentials-Grant) to get a new access\_token. If that fails, then you will need them reauthorize through the api, however keep in mind the refresh\_token is always the same, even after deactivating/reactivating the program.

---

<div class="post-metadata">

**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\
**Post date:** [October 11, 2015, 8:16pm UTC](https://staging-discuss.dev.twitch.com/t/oauth2-stay-logged-in-etc/3059/3 "2015-10-11T20:16:11Z")

</div>

Closed on October 11, 2015, 8:16pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.