Getting User ID

[Alfredo_Santo]

Hello. I am trying to do a Telegram Bot to let enter in a group only the subscribers to a specific streamer. I started to write a python script to get oauth token and get the list of subs that a user has.

secret_id=“mysecret”
redirect_uri=“https://localhost”
scopes=“user:read:email+user:read:subscriptions”
client_id=“clientid”

The first thing i do, is open this link and authorize my app:

link=“https://id.twitch.tv/oauth2/authorize?response_type=code&client_id="+client_id+"&redirect_uri="+redirect_uri+"&scope=”+scopes

After do that, i can generate my OAuth:

body = {
‘client_id’: client_id,
‘client_secret’: secret_id,
‘grant_type’: ‘client_credentials’
}
access_token = requests.post(link,body).json()[“access_token”]

An example of access_token result:

REMOVED PLEASE DO NOT LEAK TOKENS

After do that, I want to see subscribes of this user but I need his ID. So I try to get User Info in this way:

headers = {
‘Client-ID’: client_id,
‘Authorization’: 'Bearer '+access_token
}
link=“https://api.twitch.tv/helix/users”
requests.get(link,headers = headers).json()


This is the response:

{‘error’: ‘Bad Request’, ‘status’: 400, ‘message’: ‘Must provide an ID, Login or OAuth Token.’}

So, I don’t know why my token seems to be invalid. I need to get the User ID with only my access_token.

What I am missing?

[BarryCarlyon]

@Alfredo_Santo

An example of access_token result:

REMOVED PLEASE DO NOT LEAK TOKENS

Never, ever, leak tokens, tokens are like passwords and you should not leak them

@Alfredo_Santo

This is the response:
{‘error’: ‘Bad Request’, ‘status’: 400, ‘message’: ‘Must provide an ID, Login or OAuth Token.’}

So, I don’t know why my token seems to be invalid. I need to get the User ID with only my access_token.

What I am missing?

You did the first step of user oAuth, threw it out and then got a server to server token instead. (Client credentials)

So in fact you generated a client_credentials token
Such a token doesn’t represent a user, hence the error

See step 3

Getting OAuth Access Tokens

You are supposed to take the ?code in the URL when the user comes back to your app from Twitch and exchange it for a token.

In our example, your user gets redirected to:

http://localhost/?code=394a8bc98028f39660e53025de824134fb46313
    &scope=viewing_activity_read
    &state=c3ab8aa609ea11e793ae92361f002671
3) On your server, get an access token by making this request:

POST https://id.twitch.tv/oauth2/token
    ?client_id=<your client ID>
    &client_secret=<your client secret>
    &code=<authorization code received above>
    &grant_type=authorization_code
    &redirect_uri=<your registered redirect URI>

[Alfredo_Santo]

@BarryCarlyon

Never, ever, leak tokens, tokens are like passwords and you should not leak them

Oh, it was a fake token, just to do an example.

@BarryCarlyon

You are supposed to take the ?code in the URL when the user comes back to your app from Twitch and exchange it for a token.

I see the ?code= in my localhost page but how can i take that code and save it? Like in a file? To use it on my script?

Thank you

[BarryCarlyon]

your app should have some sort of method to recieve a HTTP request, since you are redirect the user out of the app to a web browser to go link.

So that method of recieving a HTTP request should be able to pull the ?code query string parameter.

Apps like these either intercept requests in a web view, or raise a temprorary web server to act as the reciving server.

[Alfredo_Santo]

I’ve done it… now i can take the user id. I am trying now to get subs list…

on Curl it works:

curl -X GET 'https://api.twitch.tv/helix/subscriptions/user?broadcaster_id=MYID&user_id=MYID -H ‘Authorization: Bearer ACCESS_TOKEN’ -H ‘Client-Id: CLIENT-ID’

on python i don’t know why but i get this:
{‘error’: ‘Unauthorized’, ‘status’: 401, ‘message’: ‘user_id should match the user in the token’}

using this:

headers = {
‘Authorization’: 'Bearer '+token_id,
‘Client-Id’: client_id
}
link=“https://api.twitch.tv/helix/subscriptions/user?broadcaster_id="+MYID+"&user_id=+”+MYID


I tried to take the value of token_id and user_id from my python script, build a string to do a curl commands and it works on command… but not in python script

[BarryCarlyon]

Why are you performing a subscription lookup where the user_id and broadcaster_id are the same ID?

if it’s not working in python then there is a bug in your python code.

[Alfredo_Santo]

Because I am testing it on myself hahaha

Can you help me with python too?

[BarryCarlyon]

Post your code with secrets removed and we can take a look

[Alfredo_Santo]

def start(code):
    token_id = getToken(code) #this take the code of ?code=something page and extract the value of "access_token"
    headers= getHeader(token_id) #generate the headers below
    user_id= getUserInfo(token_id,headers) #this return my correct id (i am testing on myself)
    ####until here all ok
    subs = getSubs(headers,user_id)
    print(subs)

def getSubs(headers,user_id):
    link="https://api.twitch.tv/helix/subscriptions/user?broadcaster_id="+streamer+"&user_id=+"+user_id
    return requests.get(link,headers = headers).json()

[BarryCarlyon]

Extra +

Line

 link="https://api.twitch.tv/helix/subscriptions/user?broadcaster_id="+streamer+"&user_id=+"+user_id

should be

link="https://api.twitch.tv/helix/subscriptions/user?broadcaster_id="+streamer+"&user_id="+user_id

[Alfredo_Santo]

Ooooooh i am dumb… thank you

[BarryCarlyon]

Am Rubber Duck