3 results found
-
Add PKCE Support to the OAuth2.0 Authorization Code Flow I am currently developing a native Android application for Twitch and want to make use of the OAuth2.0 API. Since the Twitch Authorization Server doesn't seem to support the PKCE (Proof Key for Code Exchange), i will have to put my client secret into my native application, which isn't secure at all, because the app can easily be decompiled.
This is a requirement for all native apps, as stated by the IETF in RFC 7636 (https://tools.ietf.org/html/rfc7636).
I hope to see this implemented soon, because this poses a huge security risk for all native apps and their developers.
63 votesAt TwitchCon EU 2026, we announced that PKCE will be available later this year.
-
Swagger / JSON Schema Would be helpful to provide a openapi/swagger document or json schema for the objects here
16 votes -
More detail on obtaining OAuth and OIDC tokens You provide information on how to remove a token, how to refresh a token, and how to define scopes for tokens, but you don't actually have any information on how to request a token, nor any sample code on that or applying token scopes. Given that this step is fundamental to any interaction with the Twitch API, this seems like a fairly major omission.
7 votes
- Don't see your idea?