Using client id to determine rate limits

[BarryCarlyon]

@trumpi27

When making anonymous requests to the helix API, the only way, as far as I can see, that the rate limit can be calculated is using the client ID, which we pass in through the header. My concern is that this client id can be easily stolen during the OAuth handshake. Furthermore, according to RFC6749, section 2.2, the client id should not be considered a secret.

Rate limit is by ClientID/IP Address pair

@trumpi27

Are anonymous rate limits counted separately to authenticated rate limits? Or do they work in a similar way to the moderator/ non-moderator IRC limits?

Kraken/Helix require ClientID there is no “anonymous”