To keep it simple, here’s some api calls and their HTTP status code:
https://api.twitch.tv/kraken: 400 (as expected)
https://api.twitch.tv/kraken?oauth_token=token: 200 (as expected, and identified is true)
https://api.twitch.tv/kraken/users/felkcraft: 400 (as expected)
https://api.twitch.tv/kraken/users/felkcraft?oauth_token=token: 200 (as expected)
https://api.twitch.tv/kraken/streams/twitchplayspokemon: 400 (as expected)
https://api.twitch.tv/kraken/streams/twitchplayspokemon?oauth_token=token: 400 (not expected)
I used the same oauth token each time. The token only has the scope for connecting and chatting via irc and was generated from twitchapps.com/tmi
EDIT: I found that this was also already mentioned here