yes it returns a token and i tried it also without a scope
I fixed it 
it was a case_sensitive issue 
changed from ‘Authorization’ => $header, to ‘authorization’ => $header,
here is the makeApiCall
public function makeApiCall( $params , $buildQuery = true ) {
$curlOptions = array( // curl options
CURLOPT_URL => $params['endpoint'], // endpoint
CURLOPT_AUTOREFERER => PATH_TO_CERT, // ssl certificate for localhost
CURLOPT_RETURNTRANSFER => 1, // return stuff!
CURLOPT_FOLLOWLOCATION => TRUE, // verify peer
);
if ( isset( $params['authorization'] ) ) { // we need to pass along headers with the request
$curlOptions[CURLOPT_HEADER] = TRUE;
$curlOptions[CURLOPT_HTTPHEADER] = $params['authorization'];
}
if ( 'POST' == $params['type'] && $buildQuery) { // post request things
$curlOptions[CURLOPT_POST] = TRUE;
$curlOptions[CURLOPT_POSTFIELDS] = http_build_query( $params['url_params'] );
}elseif('POST' == $params['type'] && $buildQuery == false ){
$o = true;
$curlOptions[CURLOPT_POST] = TRUE;
$curlOptions[CURLOPT_POSTFIELDS] = json_encode($params['url_params']);
} elseif ( 'GET' == $params['type'] ) { // get request things
$curlOptions[CURLOPT_URL] .= '?' . http_build_query( $params['url_params'] );
}
if(substr($curlOptions[CURLOPT_URL], -1) == "?")$curlOptions[CURLOPT_URL] = substr($curlOptions[CURLOPT_URL],0, -1);
$ch = curl_init();
curl_setopt_array( $ch, $curlOptions );
$apiResponse = curl_exec( $ch );
if ( isset( $params['authorization'] ) ) { // we have headers to deal with
// get size of header
$headerSize = curl_getinfo( $ch, CURLINFO_HEADER_SIZE );
// remove header from response so we are left with json body
$apiResponseBody = substr( $apiResponse, $headerSize );
// json decode response body
$apiResponse = json_decode( $apiResponseBody, true );
} else { // no headers response is json string
// json decode response body
$apiResponse = json_decode( $apiResponse, true );
}
curl_close( $ch );
return array(
'status' => isset( $apiResponse['status'] ) ? 'fail' : 'ok', // if status then there was an error
'message' => isset( $apiResponse['message'] ) ? $apiResponse['message'] : '', // if message return it
'api_data' => $apiResponse, // api response data
'endpoint' => $curlOptions[CURLOPT_URL], // endpoint hit
'url_params' => $params['url_params'] // url params sent with the request
);
}
I use this function for every twitch request