IGBD only access with token

API
1

Hi,

I want to use IGDB to make some basic queries to get list of games, publishers, etc and not any specific twitch content. Following their doc on authentication I am making a simple call to /token from my server and I am getting the token correctly. However, this token does not come with a refresh_token given that it is intended for server to server only. If I want to reuse said token for a given user, I would have wanted to store it in their cookies and refetch a new token once the first one has expired.

Looking into the general twitch doc, I figure out that I needed to get the user to authorize my app however the app itself doesn’t need any of their twitch user data, which then seems overkill (and with the app I am building, very inconvenient) to have user grant access.

Is there something I am missing? A way to make multiple call with the same token without needing the user to give my app permission to read their data since I do not need their data? :thinking:

Thanks!

2

DO NOT DO THIS

A token that can call IGDB’s API doesn’t belong to the user, and shouldn’t be visible to users.

When an app access token expires, just make a new one

Not for IGDB no, IGDB only supports App Access Tokens.

So all requests for IGDB should work as follows:

  • users visits your website and is logged out of Twitch to your site
  • user makes a request for a game
  • your website calls your backend
  • the backend makes a call to IGDB keeping the Token hidden form the user.

IGDB doesn’t work with users tokens so getting a user token does not help you access IGDB data.

IE: the front end doesn’t directly call IGDB.
Your front end calls your backend and the backend proxies the request to IGDB

3

IE: the front end doesn’t directly call IGDB.
Your front end calls your backend and the backend proxies the request to IGDB

Right, that’s what I was doing currently. So my newbie question then is: where can I store this app token on the server (should I even?). Do I end up always calling the auth endpoint before making the data query or do I store the token in the DB? Somewhere else? Thanks a lot!

4

Wherever you want.

Some of that depends on what language you are using for your backend.

Store it in memory
Store it in Redis
Store it in a DB

You could do this but it’s generally not advised.

You should generate and use a token till it’s close to expiration

Sure that works!

1 Like
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.