User login flow: https://passport.twitch.tv/integrity 400 with erc 2025

  1. I’m not staff so I cannot speak to Twitch’s API’s. I’m just another third party developer.
  2. You are not calling an API you are embedding the Twitch main website in a “not supported browser”
  3. It’s not forbidden per sae, it’s just not expected to work as Twitch doesn’t test there and/or thinks the browser is a bot or something. Short of the “bad security for users” standpoint.

If login doesn’t work for some reason (unexpected error) then it’s likely a browser not supported/blocked issue.

Speculation: yes

perhaps but is more secure and trustworthy by users

If you launch an external browser, the likely hood is that the user is already logged into Twitch.

So if you launch an external bnrowser the user clicks one button (it not prior authed)
Then come back to the game

otherwise

If your embed the Twitch website.
The user has to login
Find their password from their password manager
Then two FA in
Then click the accept dialog
Then come back to the game

Not too much you can do that especially with the recent supported browser changes

I can think of a number of ways to bypass that paticular invoke issue.

sadly yeah, you’d have to auth to your own system. and link Twitch to your account system. Which is usually what the bigger guys do (especially if running Twitch drops for inventory unlocks for example)

But if you are read only then you just need the channel name. Not a full token. So do you really need a token if you are only reading chat spam messages? (Yeah this depends on the use case)