Just create a clip using the website and look at the request using the Chrome Developer Tools, Firebug, or whatever. Rebuild that request in your code, verify that it works and then you can start removing non-essential headers/cookies. If it suddenly stops working you remove something that’s required.
I’m not sure what you’re asking. No, I haven’t circumvented Twitch’s login and I recommend you stay away from that too. Using undocumented APIs is one thing, but fiddling with the login is definitely against ToS.