# Pubsub Auth with accesstoken? **URL:** \ **Category:** API\ **Created:** [March 6, 2019, 6:48pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383 "2019-03-06T18:48:49Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 6, 2019, 6:48pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/1 "2019-03-06T18:48:49Z")
Hello, I’m currently testing around with pubsubs. At the moment I have the problem that I have to send an authtoken within the request. The problem is that I only have the accesstoken, refreshtoken … So how do I work around that problem, do I have to request the authtoken oder how can I use pubsubs without the authtoken. When I pass the accestoken as authtoken it responses with: {“type”:“RESPONSE”,“error”:“ERR\_BADAUTH”,“nonce”:""} My code socket.onopen = (event: any) =\> { console.log(“Connection established”); ``` let data = { "type": "LISTEN", data: { "topics": ["channel-bits-events-v1.44322889"], "auth_token": accessToken } } socket.send(JSON.stringify(data)); } ``` Hopefully anyone can help me with that problem Thank you Shorty ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 6, 2019, 7:21pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/2 "2019-03-06T19:21:15Z")
Your code is correct. You should pass the `accessToken` as the `auth_token` But for the bits topics, you need a token with - v1 - any scope - v2 - bits:read As documented > **[PubSub](https://dev.twitch.tv/docs/pubsub/#topics)** > > PubSub Guide This is indicative you are passing a token with no scopes at all on it. ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 6, 2019, 8:43pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/3 "2019-03-06T20:43:46Z")
So do I have to pass a scope within the request or when I redirect the user to authenticate my app? At the moment I only ask for the ‘user:edit’ scope. Sry but I didnt quite get what to do exactly now. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 6, 2019, 9:22pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/4 "2019-03-06T21:22:25Z")
Is your access token still valid? ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 6, 2019, 9:55pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/5 "2019-03-06T21:55:36Z")
I can request followers and other things so I guess yes ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 6, 2019, 10:23pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/6 "2019-03-06T22:23:29Z")
Try getting a token with `bits:read` and the v2 topic If your token only has `user:edit` I wonder if you have stumbled on a bug, as `user:edit` is a helix scope and your token only has helix scopes ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 7, 2019, 7:41pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/7 "2019-03-07T19:41:11Z")
Hey, it still doesnt seem to work. ``` let data = { "type": "LISTEN", data: { "topics": ["channel-bits-events-v2.46024993"], "auth_token": accessToken } } ``` And the credentials object I safe looks like this ``` 1. channel: "InL_Shorty" 2. type: "twitch" 3. access_token: "XXX" 4. refresh_token: "XXX" 5. scope: "bits:read,user:edit" ``` 1. token\_type: “bearer” ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 7, 2019, 7:44pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/8 "2019-03-07T19:44:38Z")
``` let data = { type: 'listen', nonce: ' sdfkhjasdjkfhsdjkafasdf', data: { topics: ["channel-bits-events-v2.46024993"], auth_token: 'abcabcabc' } } ws.send(JSON.stringify(data)); ``` The Auth Token should **NOT** be preceeded by oAuth/Bearer. It should be JUST the token. ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 7, 2019, 7:50pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/9 "2019-03-07T19:50:39Z")
At the moment I request the authcode `[https://id.twitch.tv/oauth2/authorize?client\_id=b0o7fl44x6a3hom3omdsey4c6asq83&redirect\_uri=http://localhost:4200/auth/twitch&response\_type=](https://id.twitch.tv/oauth2/authorize?client_id=b0o7fl44x6a3hom3omdsey4c6asq83&redirect_uri=http://localhost:4200/auth/twitch&response_type=) > code &scope=user:edit bits:read` So I have to change this to the auth token and get the access token with the authtoken aswell, right? ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 7, 2019, 7:51pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/10 "2019-03-07T19:51:36Z")
Yup. You need to do Step 1) Redirect user to twitch on that URL Step 2) Exchange the returned code for a access token aka auth token (they are one and the same) Step 3) ??? Step 4) Profit ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 7, 2019, 8:10pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/11 "2019-03-07T20:10:42Z")
Im really sorry for asking again but I got the authtoken now. How do I get the accesstoken, refreshtoken…? I cant find the url for requesting it with the authtoken. Im using OAuth Implicit Code Flow. Or am I on the complete wrong way? ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 7, 2019, 8:12pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/12 "2019-03-07T20:12:03Z")
response\_type code is for OAuth Authorization Code Flow not implicit > **[Getting OAuth Access Tokens](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#oauth-authorization-code-flow)** > > Getting OAuth Access Tokens ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 7, 2019, 8:12pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/13 "2019-03-07T20:12:42Z")
Yeah I changed that to response\_type=token ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 9, 2019, 1:37pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/14 "2019-03-09T13:37:37Z")
Okay, so I tried to change some things. For example downgrading to kraken API getting credentials and stuff from the kraken API([https://api.twitch.tv/kraken/oauth2/token?](https://api.twitch.tv/kraken/oauth2/token?), …). I still get the same error like mentioned above. > Step 2) Exchange the returned code for a access token aka auth token (they are one and the same) What do you excactly mean with that? Currently I: - Send my user to auth [https://api.twitch.tv/kraken/oauth2/authorize](https://api.twitch.tv/kraken/oauth2/authorize)? - Get the code from the URL Parameters and requesting tokens [https://api.twitch.tv/kraken/oauth2/token](https://api.twitch.tv/kraken/oauth2/token) - { access\_token: ‘REMOVED’, refresh\_token: ‘REMOVED’, scope: [‘user\_read’, ‘user\_subscriptions’], token\_type: ‘bearer’ } save that to the database - ``` let data = { "type": "LISTEN", data: { "topics": ["channel-subscribe-events-v1.44322889"], "auth_token": accessToken } } socket.send(JSON.stringify(data)); ``` And connect to the socket > {“type”:“RESPONSE”,“error”:“ERR\_BADAUTH”,“nonce”:“”} I still get that error. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 9, 2019, 1:38pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/15 "2019-03-09T13:38:51Z")
You shouldn’t leak _any_ part of a token. Don’t shove XXXXX in it just remove it all. What you are doing looks correct. But is the access token for user 44322889? ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 9, 2019, 1:54pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/17 "2019-03-09T13:54:31Z")
No, thats the example url. My bad. I changed it to the correct userId and it still gives me the same error. I requested the userId from the ([https://api.twitch.tv/kraken/user](https://api.twitch.tv/kraken/user)) endpoint Edit: Sry my pc didnt show the post ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [March 9, 2019, 2:10pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/18 "2019-03-09T14:10:27Z")
I’m out of ideas here. It’s working perfectly fine for me. But your code is missing a nonce: for example: ```auto { "type": "LISTEN", "nonce": "44h1k13746815ab1r2", "data": { "topics": ["channel-bits-events-v1.44322889"], "auth_token": "cfabdegwdoklmawdzdo98xt2fo512y" } } ``` from > **[PubSub](https://dev.twitch.tv/docs/pubsub/)** > > PubSub Guide Which yes is optional. But it’s the only difference between my code and your code that I can see ---
**Author:** ![Dist](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://staging-discuss.dev.twitch.com/u/Dist)\ **Post date:** [March 9, 2019, 4:27pm UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/19 "2019-03-09T16:27:09Z")
Try checking the validity of your token [https://dev.twitch.tv/docs/authentication/#validating-requests](https://dev.twitch.tv/docs/authentication/#validating-requests) Make sure that the token is valid, has the correct scope, and the user id in the token matches that of the user id in the topic you’re attempting to listen to on Pubsub. ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 10, 2019, 11:02am UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/20 "2019-03-10T11:02:13Z")
I send a validate rqeuest and got the right information. Userid is the same as in the listen message send to the Pubsub. ---
**Author:** ![InL\_Shorty](https://avatars.discourse-cdn.com/v4/letter/i/f19dbf/32.png) [@InL\_Shorty](https://staging-discuss.dev.twitch.com/u/InL_Shorty)\ **Post date:** [March 10, 2019, 11:12am UTC](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383/21 "2019-03-10T11:12:18Z")
Well I finally found the error. I needed to switch to the kraken API in order to use it and I had the ‘user\_subscriptions’ instead of ‘channel\_subscriptions’ scope… Thank you all for your help! [Next page](https://staging-discuss.dev.twitch.com/t/pubsub-auth-with-accesstoken/20383.md?page=2)