Getting authorization token within url fragment

zvad · December 14, 2020, 11:32pm

So today i tried to “connect” to twitch api with php but now im stuck on that authorization token is in the url fragment and i dont know how to get it
URL :

https://localhost/Zaludov/redirect.php/#access_token=TOKEN_HERE&scope=SCOPE_HEREl&token_type=bearer

Code: <?php

use NewTwitchApi\HelixGuzzleClient;
use NewTwitchApi\NewTwitchApi;

require 'vendor/autoload.php';
include_once('lib/urlGen.php');
include_once('lib/Config.php');

$urlGen = new urlGen();

echo '<a href="'.$urlGen->generateURL().'">Authenticate Me</a><br/>';

if(isset($_GET['error'])){
    echo "error: " . $_GET['error'] . "<br>";
    if(isset($_GET['error_description'])){
        echo "error description: " . $_GET['error_description'] . "<br>";
    }
}
if(!isset($_GET['access_token'])){
    echo "code not set" . "<br>";
    return;
}

$conf = new Config();
$accessToken = $_GET['access_token'];

var_dump($accessToken);

// The Guzzle client used can be the included `HelixGuzzleClient` class, for convenience.
// You can also use a mock, fake, or other double for testing, of course.
$helixGuzzleClient = new HelixGuzzleClient($conf->getClientId());

// Instantiate twitchApi. Can be done in a service layer and injected as well.
$newTwitchApi = new NewTwitchApi($helixGuzzleClient, $conf->getClientId(), $conf->getClientSecret());

try {
    // Make the API call. A ResponseInterface object is returned.
    $response = $newTwitchApi->getUsersApi()->getUserByAccessToken($accessToken);

    // Get and decode the actual content sent by Twitch.
    $responseContent = json_decode($response->getBody()->getContents());

    // Return the first (or only) user.
    $user = $responseContent->data[0];
} catch (GuzzleException $e) {
    // Handle error appropriately for your application
    exit("error occured");
}

print_r($user);

BarryCarlyon · December 14, 2020, 11:35pm

For PHP you really should not be using implicit auth. As a “server” cannot see the URL Fragment. Implicit auth is intended to be used for apps that don’t have a server.

You should use something like

Redirect to Twitch
They come back with a code
Exchange the code for an access token
???
Profit

zvad · December 14, 2020, 11:57pm

ok and can you give me some suggestion on how to exchange the code for an acces token

BarryCarlyon · December 14, 2020, 11:58pm

github.com

BarryCarlyon/twitch_misc/blob/master/authentication/user_access_generator/php/index.php#L32



        // note: not testing the HTTP response codes,
        // since we don't care too much as logging out
        curl_close($ch);
    }

    session_destroy();
    header('Location: /');

    exit;
} else if (isset($_GET['code']) && $_GET['code']) {
    // we have a code on the address line so lets parse and exchange

    // validate the state/nonce
    if (isset($_SESSION['nonce']) && isset($_GET['state']) && $_SESSION['nonce'] == $_GET['state']) {
        // lets exchange the code for an access token
        $ch = curl_init('https://id.twitch.tv/oauth2/token');
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, array(
            'client_id' => CLIENT_ID,

zvad · December 15, 2020, 12:35am

Ok thanks I got it working somehow but now I want to ask if I can reuse the south token or the authorization code so the user can walk through the process just once

BarryCarlyon · December 15, 2020, 12:37am

The south token? What is “south token”?

The ?code= is valid for one exchange to an access token.

Then you may store and use the access token (and it’s refresh token)
You can use the refresh token to generate a new token if/when the access token expires.

zvad · December 15, 2020, 12:44am

Ok thanks for help(sorry for the south token I was writing from phone )

zvad · December 15, 2020, 10:33am

nvm i run into another problem the api im using doesnt support getting subscribers so how can i get the data from user acces token(or how to do the request) and how can i check if user has sub somewhere

BarryCarlyon · December 15, 2020, 12:54pm

To get subscriptions status, requires an oAuth token from the broadcaster, with the relevant scopes attached

So if you want to see if I am subscribed to CohhCarnage and/or Lirik, you need

A token from CohhCarnage
A token from Lirik
My userID, (usually got from asking me to login to your site)

So you need user access tokens from the broadcaster you want to lookup against. A “privileged” access token is generated the same way as you would a “non privileged” token.

A more lengthy answer to the same question is on Check if user is subscriber - API - Twitch Developer Forums

zvad · December 15, 2020, 3:19pm

ok and is it possible to check larger volume of people something like 100 - 300

BarryCarlyon · December 15, 2020, 3:20pm

The first parameter defines the page size

Then you will get a pagination cursor value

use that with the after parameter to navigate pages of results

zvad · December 15, 2020, 5:07pm

ok

what is the broadcaster id is it the id i get with email name etc.
2.when im getting subscribers max number in request is 100 so i need to send multiple requests?

BarryCarlyon · December 15, 2020, 5:09pm

You can use the token with the users endpoint to get the users ID. A user is also a broadcaster. different works are used to describe with endpoints that deal with more than one users
Yes, load a page, get the cursor, load the next page. Repeat till no more cursor

zvad · December 17, 2020, 12:26am

Is it somehow possible to get the “sub streak”(the think you got next to name in chat) i want to filter only subscribers with something like 2 months streak for example

BarryCarlyon · December 17, 2020, 12:28am

“Tenure data” is not in the Helix (or kraken) APIs

You can only “capture” it from Twitch chat when a user shares their sub in chat