Can you please double check the meaning of the sentences covered in this page (ex: Send the user you want to authenticate to your registered redirect URI. -> you dont't send them to the redirect URI but to the Twitch uri under the cited pharagraph) And the 'token+idtoken' is not equal to 'token%20idtoken' (the 'token id_token' is) the '+' signs encoded to '%2B' which trows an error whereas the ' ' (space) encoded to '%20' which returns the desired result.