# Sending permissions\_received in oauth\_receipt broken **URL:** \ **Category:** Extensions\ **Created:** [September 9, 2017, 6:04pm UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884 "2017-09-09T18:04:38Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![WebFreak](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/webfreak/32/3276_2.png) [@WebFreak](https://staging-discuss.dev.twitch.com/u/WebFreak)\ **Post date:** [September 9, 2017, 6:04pm UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/1 "2017-09-09T18:04:38Z")
I am successfully getting the OAuth prompt and it redirects to my page where I then call `window.close()` to close the popup and on the server side I parse the JSON scope parameter and then `PUT https://api.twitch.tv/extensions///oauth_receipt?channel_id=` and it actually returns 204 No Content. But then the twitch side is only loading and never finishing. In the background I can see how it says it’s active for a fraction of a second, but then it goes back to the activate dropdown. My testers have reported the same thing and I have checked the documentation [Extensions Reference | Twitch Developers](https://dev.twitch.tv/docs/extensions/reference#set-extension-broadcaster-oauth-receipt) over and over, but it simply doesn’t stay activated. ![https://i.webfreak.org/fWY4iH.png](https://d1d6mrmdu7ztse.cloudfront.net/uploads/default/original/2X/3/33522e98355f04a69bf3460ba11884b3846a7777.png) I send `{"permissions_received":true}` with `Content-Type: application/json` and include the Client-Id of the extension and the Authorization header with a generated JWT with a exp of `unix time + 24h`. Would be nice if someone who had success with this could help me with this. Also is there some way to verify the scope or get a verified channel ID so users won’t be able to intercept and change the request and change the scope to inject false information? Right now it doesn’t really matter for my extension because the access token isn’t used to do anything important, but it seems like a security risk. ---
**Author:** ![PepperedPig](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PepperedPig](https://staging-discuss.dev.twitch.com/u/PepperedPig)\ **Post date:** [September 11, 2017, 4:11am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/2 "2017-09-11T04:11:49Z")
I’m having the same issue with this. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [September 11, 2017, 6:56am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/3 "2017-09-11T06:56:49Z")
> [@WebFreak](#): > > Also is there some way to verify the scope or get a verified channel ID so users won’t be able to intercept and change the request and change the scope to inject false information? Pass the oauth you get back to [https://api.twitch.tv/kraken/](https://api.twitch.tv/kraken/) to verify the scopes for the key: ```auto { "token": { "valid": true, "authorization": { "scopes": [ "channel_check_subscription", "channel_subscriptions", "user_read" ], "created_at": "2017-05-19T13:15:56Z", "updated_at": "2017-05-19T13:15:56Z" }, "user_name": "SOMEONE", "user_id": "SOMEID", "client_id": "ACLIENT" } } ``` then read authorizations/scopes check the scopes match and then do the PUT 204 No Content is correct, 204 means “created” and in some cases will contain a follow up location in headers (normally to the created responses) so there should be no “body data” I’ve not needed any scopes yet since my privater caster applications I already have oAuth’s stored for their bots. So can’t comment on the rest (I may build a test flow for it later) ---
**Author:** ![ncee](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@ncee](https://staging-discuss.dev.twitch.com/u/ncee)\ **Post date:** [September 12, 2017, 1:46am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/4 "2017-09-12T01:46:30Z")
I am also having same exact issue. Last week the oauth scopes with activate wouldn’t even prompt up at all and now it will prompt but won’t finish even after successful PUT for oauth receipt. I think they are still trying to get oauth through extensions setup because I’ve seen a live extension that is doing oauth the ‘traditional’ way and doing through the configure page instead. Hopefully they fix it soon ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [September 12, 2017, 8:00am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/5 "2017-09-12T08:00:26Z")
That might have been an extension released before changing the rules and/or the go live date and/or the oauth stuff existing. So it’s unfair to compare because as far as I can see there has been one public release of an extension post go live date. ---
**Author:** ![WebFreak](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/webfreak/32/3276_2.png) [@WebFreak](https://staging-discuss.dev.twitch.com/u/WebFreak)\ **Post date:** [September 14, 2017, 5:03pm UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/6 "2017-09-14T17:03:24Z")
Seems like twitch has fixed it now ---
**Author:** ![ncee](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@ncee](https://staging-discuss.dev.twitch.com/u/ncee)\ **Post date:** [September 16, 2017, 2:38pm UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/7 "2017-09-16T14:38:01Z")
yup, working for me now, thanks twitch ---
**Author:** ![offbeatlive](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/offbeatlive/32/3188_2.png) [@offbeatlive](https://staging-discuss.dev.twitch.com/u/offbeatlive)\ **Post date:** [January 17, 2018, 2:30am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/8 "2018-01-17T02:30:16Z")
I’m getting this issue, exactly as described in OP (though using node instead). I’ve tested on my machine and on another test machine and account, the same behavior occurs in both cases. Can’t help but feel like I’m doing everything correctly, but of course I may be missing something. Any ideas? ---
**Author:** ![offbeatlive](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/offbeatlive/32/3188_2.png) [@offbeatlive](https://staging-discuss.dev.twitch.com/u/offbeatlive)\ **Post date:** [January 19, 2018, 4:17am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/9 "2018-01-19T04:17:13Z")
Got this working after taking some time away from my code. I wasn’t passing along the data payload with my request (I supplied the data but in the wrong place). The entire time, however, I **was still getting 204 responses from Twitch** , despite not providing the data. Even with the data payload received, Twitch sends the same status code and message, which was confusing. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 19, 2018, 11:40am UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/10 "2018-01-19T11:40:30Z")
> [@offbeatlive](#): > > I was still getting 204 responses from Twitch, despite not providing the data Weeeeellllllll, logically with no payload that kinda reads as “well there was an authorisation, but it wasn’t the authorisation I wanted” aka “permissions\_received” being false. ---
**Author:** ![offbeatlive](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/offbeatlive/32/3188_2.png) [@offbeatlive](https://staging-discuss.dev.twitch.com/u/offbeatlive)\ **Post date:** [January 19, 2018, 6:26pm UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/11 "2018-01-19T18:26:32Z")
I still maintain that it was confusing, seeing as it’s not obvious that the `oauth_receipt` endpoint expects anything _other than_ `{ permissions_received: true }` (including an empty payload). Also, since `2XX` response codes are categorically `Success` reponse codes, I think sending a `204` in this case is misleading: Without a payload the request doesn’t successfully report that OAuth permissions were accepted. Had I gotten a `400` for an empty payload in the first place, I would’ve known that the error was in my code. All that being said, I do recognize that this is quite a marginal edge case for a very simple endpoint. So I’m just glad it’s working now. P.S. Long overdue thanks @BarryCarlyon, I’ve picked up many, very valuable techniques and info from your posts on this forum. ---
**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [January 19, 2018, 8:11pm UTC](https://staging-discuss.dev.twitch.com/t/sending-permissions-received-in-oauth-receipt-broken/11884/12 "2018-01-19T20:11:37Z")
> [@offbeatlive](#): > > I still maintain that it was confusing Totally agreed! > [@offbeatlive](#): > > P.S. Long overdue thanks o7 not a problem! Happy to help!