Never getting refresh_token

[Rykian]

Hi there!

I’m currently developing a node web-app which follow Twitch subs for one specific account.

Everything seems to work correctly except for the part where my token expires because I never got a response from Twitch API including refresh_token field.

My admin user (the account which subs need to be watched) has the current scopes: user:read:email user:edit channel_subscriptions channel_check_subscription.

Is there something with these scopes preventing from sending refresh_token property?

Thanks in advance.

[BarryCarlyon]

Whats the URL you are sending the user to for the first leg of oAuth?

[Rykian]

Hmmm, that URL : https://id.twitch.tv/oauth2/authorize?client_id=<client-id>&redirect_uri=<my-url>&response_type=code&scope=user:read:email%20user:edit%20channel_subscriptions%20channel_check_subscription ? (with a real client_id and redirect_uri of course ;))

[BarryCarlyon]

That looks correct,

And I assume you are redirecting the user there, not doing a cURL fetch or anything silly?

Whats the second leg of your oAuth look like (the POST for code->token exchange)

[Rykian]

@BarryCarlyon

And I assume you are redirecting the user there, not doing a cURL fetch or anything silly?

Nop, everything is done in the browser for this side!

@BarryCarlyon

Whats the second leg of your oAuth look like (the POST for code->token exchange)

It’s something like this : https://id.twitch.tv/oauth2/token?client_id=${TWITCH_CLIENT_ID}&client_secret=${TWITCH_CLIENT_SECRET}&code=${code}&grant_type=authorization_code&redirect_uri=${TWITCH_REDIRECT_URI}

Wohhh, what? wait! refresh_token is given as response to this request? So it’s at this step that we must store refresh_token to use it when access_token expires?
I’ve never understood that, either I must read more closely document or it’s not very explicit :')

[BarryCarlyon]

@Rykian

Wohhh, what? wait! refresh_token is given as response to this request? So it’s at this step that we must store refresh_token to use it when access_token expires?
I’ve never understood that, either I must read more closely document or it’s not very explicit :’)

Yes the response to that is

• access_token
• expires_in
• refresh_token
• scope
• token_type

Token_type is usually “Bearer” and expires_in is the time in seconds. scope is a copy of the requested scopes

My tests this morning on that end point are returning a refresh_token in the response, so did it not? And you found it now? Or you got a broken™