Governance
Auditing Connected Apps and Devices on Your Twitch Account
Every connected app and session is a standing line of access until it is checked and removed.
Is this your situation?
You do not know every app and device that can still act on your channel. A regular review of connections and sessions replaces that uncertainty with a known list.
Where teams go wrong
- Old apps left connected You may not remember every app you once allowed to access your account.Why it happens: Users may have allowed 3rd party apps limited access to their account in the past.
- Tokens outlive the review You assume a token expired, but it may still be valid.Why it happens: Access and refresh tokens can become invalid if the user disconnects the app.
- Password change assumed enough You change your password and expect every connection to be cleared.Why it happens: Access and refresh tokens can become invalid if the user changes their password.
- Browser extensions ignored You review account connections but skip the extensions in your browser.Why it happens: Reviewing installed Browser Extensions and removing unrecognized ones is a recommended recovery step.
What good practice looks like
| Practice | What it looks like | Why it holds up |
|---|---|---|
| Disconnect unused apps | Disconnect the app under Other Connections in Connections Settings. | You no longer see the app listed as connected. |
| Treat tokens like passwords | Access tokens, refresh tokens, and client secrets are treated like a password and safeguarded. | Keeps credentials from being exposed. |
| Revoke at the source | An app can revoke an access token with a POST request to the revoke endpoint. | Ends the app's access directly. |
| Review browser extensions | Review installed Browser Extensions and remove unrecognized or untrusted ones. | Clears access paths outside Twitch settings. |
How Twitch handles this
- Access and refresh tokens can become invalid if the token expires.
- Access and refresh tokens can become invalid if the user changes their password.
- A token also becomes invalid when the app is disconnected from the account's connections page.
- Once a token is invalid, API requests using it return HTTP status code 401 Unauthorized.
- An app can revoke an access token by sending a POST request to the Twitch revoke endpoint.
Before you start
- Check connected apps list Apps allowed limited access in the past remain connected until removed.Verify: Review the Other Connections section of Connections Settings.
- Confirm token handling Access tokens, refresh tokens, and client secrets should be treated like a password.Verify: Check that no token is stored or shared in plain text.
- Check browser extensions Unrecognized or untrusted browser extensions can carry access beyond Twitch settings.Verify: Open the browser's extensions page and review each entry.
- Check installed programs Reviewing installed programs or apps on devices used to access Twitch is a recommended recovery step.Verify: List installed programs on each device used to access the account.
Which scenario is yours?
- Is an app no longer in use? Disconnect the app under Other Connections in Connections Settings.
- Did a token stop working unexpectedly? API requests with an invalid token return HTTP status code 401 Unauthorized.
- Is the password being changed as part of the review? Access and refresh tokens can become invalid when the user changes their password.
- Is a browser extension unrecognized? Reviewing installed Browser Extensions and removing unrecognized ones is a recommended recovery step.
- Does an app keep an open OAuth session? That app must call the validate endpoint to confirm its access token is still valid.
Keeping this working over time
- A connected app that no longer needs access still holds it until it is disconnected.
- Treating access and refresh tokens like a password keeps them from becoming the point of loss, as explained in structuring moderator access.
- A revoked or expired token still requires a fresh token obtained through the appropriate flow before the app works again.
- Reviewing installed programs on devices used to access the account closes paths a settings page alone does not reach.
If control is already lost — Secure a Twitch Account While You Still Have Access
Keeping track of who has access
You grant access to apps, devices, and people at different moments, and some of it lingers unreviewed. You may not remember which connection still has a hold on your channel. Delvia is built to show who and what holds access across people, in one place. That view turns a scattered set of permissions into something you can check whenever you choose.
Was this helpful?