Confused about authorization token expiring

[MrAmericanMike]

I’m following this documentation in order to get an access token that I can use with the “tmi.js” library. This library requires a username and an oauth token.

Getting OAuth Access Tokens

The token I will have to use it, first to get the username and then finally be able to create the tmi.js instance to connect to a channel.

What I don’t understand is that the token has expiration (I know I can generate a token at Twitch Chat Password Generator that wont expire)

So how do I generate a token that doesn’t expire?

[BarryCarlyon]

@MrAmericanMike

What I don’t understand is that the token has expiration (I know I can generate a token at Twitch Chat Password Generator that wont expire)

You don’t

all tokens expire.

You would normally NEVER EVER USE SOMEONE ELSES GENERATOR EVER FOR PRODUCTION

And create you own oAuth flow.
This lets you use code flow to get an access and refresh token.
Then you would use the refresh token to get a new access token

[MrAmericanMike]

But the ones generated by that website last “A lot” I mean, I think I have had those oauth tokens on some accounts and they have been working for 30 days +

Wont the ones generated with the Authorization code grant flow expire after about 4 hours.

I’m guessing for this case I can use the Implicit grant flow (I though this one was short lived) but apparently no. It’s different from other platforms. In Twitch case, this one doesn’t mention any expiration at all. Which is weird.

[BarryCarlyon]

@MrAmericanMike

But the ones generated by that website last “A lot” I mean, I think I have had those oauth tokens on some accounts and they have been working for 30 days +

legacy client ID. Infinte length tokens are not the “normal” way of things existing.

@MrAmericanMike

Wont the ones generated with the Authorization code grant flow expire after about 4 hours.

And come with a refresh token to use meaning you can continue to operate

@MrAmericanMike

I’m guessing for this case I can use the Implicit grant flow (I though this one was short lived) but apparently no.

Implict and client creds are around 60 days
Regular code flow is 4 hours, refreshable, so in theory, infinite

@MrAmericanMike

In Twitch case, this one doesn’t mention any expiration at all. Which is weird.

What doesn’t mention expiration this is unclear.

[MrAmericanMike]

@BarryCarlyon

What doesn’t mention expiration this is unclear.

The response that comes from an Implicit doesn’t come with “expires_in”

Getting OAuth Access Tokens

http://localhost:3000/
    #access_token=73d0f8mkabpbmjp921asv2jaidwxn
    &scope=channel%3Amanage%3Apolls+channel%3Aread%3Apolls
    &state=c3ab8aa609ea11e793ae92361f002671
    &token_type=bearer

Will experiment with the one that lasts 4 hours and see what happens after been connected 4 hours to a channel, if it still can send messages or a “re-authorization” needs to happen causing the bot to disconnect from chat missing commands during that process.

[BarryCarlyon]

@MrAmericanMike

The response that comes from an Implicit doesn’t come with “expires_in”

Then call the validate token endpoint to fetch it.

I would have to check, but I believe it’s part of the spec not to return expiration here for this token type.

@MrAmericanMike

Will experiment with the one that lasts 4 hours and see what happens after been connected 4 hours to a channel, if it still can send messages or a “re-authorization” needs to happen causing the bot to disconnect from chat missing commands during that process.

You won’t need to reconnect as the bot won’t get kicked when the token dies.

But you will need to regenerate the token in order to ban/timeout/other actions via the API.

[MrAmericanMike]

@BarryCarlyon

You won’t need to reconnect as the bot won’t get kicked when the token dies.

But you will need to regenerate the token in order to ban/timeout/other actions via the API.

Oh good to know. Thanks a lot Barry.