Invalid Client Secret when trying to get Access Token

[SushiKishi]

Most of the responses I see in the search box were “I copied the wrong ID” and about chat access – I’m just trying to get access to some of my metric (follower count, subscriber or subpoint count).

I’m pretty sure I can PHP my way to the data I want once I can get to it, but most of the coding examples I’ve Googled are for the older API. I’ve pieced together from examples something I think should validate me for the new API and then pull the data I want, but I’m getting hung up on the first part here.

Here’s the code:

function get_your_token_curl($url, $cid, $cse) {
	

	$ch = curl_init();	

	curl_setopt($ch, CURLOPT_URL,$url);
	curl_setopt($ch, CURLOPT_POST, 1);
	curl_setopt($ch, CURLOPT_POSTFIELDS,
				"client_id=".$cid.
				"&client_secret=".$cse.
				"grant_type=client_credentials	
				&scope=channel:read:subscriptions" 
				);
				
	$data = curl_exec($ch);
	curl_close($ch);

	return $data;
	
}



$cid="<My Client ID from my app on the Developer Dashboard>";
$cse="<My Client Secret from my app on the Developer Dashboard>";

//get App Access token
$url = "https://id.twitch.tv/oauth2/token";
$json_array = json_decode(get_your_token_curl($url, $cid, $cse), true);

echo "Check 1: <br />";
print_r($json_array);

I’m getting a 403 – invalid client secret error. I’ve generated a new one and copy-pasted it a couple of times, so that’s where I’m stuck. I don’t know a ton about PHP; anything I needed to get from an API I’ve been able to do without the curl-ing, so I could be coming at it from the completely wrong angle.

The print_r simply returns a “1” (no quotes) at this point, if that helps diagnose things at all.

[BarryCarlyon]

Your curlopt_postfields is incorrectly formatted

See twitch_misc/authentication/app_access_tokens/php at main · BarryCarlyon/twitch_misc · GitHub for a PHP example

Should be an array like

curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'client_id' => CLIENT_ID,
    'client_secret' => CLIENT_SECRET,
    'grant_type' => "client_credentials"
));

[SushiKishi]

There we go, formatting the postfields as an array did the trick. Thank you!

I then ran into a bit of a sticking point with it then telling me my OAuth Token was missing, but was eventually able to figure it out on my own. So for anyone else who might run into similar issues in PHP:

1. Format your POST fields as an array when generating your token, then
2. There’s a difference between CURLOPT_HEADER and CURLOPT_HTTPHEADER. You want the second one.

Now it’s telling me that SushiKishi isn’t an integer, which…yeah. Now that I’ve got my foot in the door, I think I see the flow to go from my Username to my User ID to the data I want. I’ve seen your username pop up a lot when searching around, so from all of us you’ve helped along the way, thank you!