Skip to content
Translate Ideas and Comments
Choose language:
There was an error during translation
← Twitch UserVoice

Settings and activity

1 result found

  1. Add PKCE Support to the OAuth2.0 Authorization Code Flow

    63 votes

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    9 comments  ·  Developers » API  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    An error occurred while saving the comment
    couchdeveloper commented  · 

    PKCE is absolutely required in modern security standards.

    It should also be _required_ for public clients by Twitch's Auth API. Not only because of the security implications, but also because not having PKCE encourages developers to follow worst practices, even multiplying the security risks. With PKCE, a better user experience can be achieved, too - since a refresh token can be utilised.

    I wholeheartedly support the other commenters, and IMHO, it seems a bit disturbing, that Twitch does not provide support for it. In the best case, on the server, it might be just a configuration parameter in one of the middleware, which needs to be set to `true`. Adding PKCE on the client takes roughly an hour and a few lines of code.