Connected App Still Has Access to Your Twitch Account

Is this your situation?

The short answer

What you see, and why

Check these first

• Check your connections settings. The token becomes invalid when you disconnect the app from the connections page and click Disconnect next to its name.Verify: Confirm the app's name no longer appears under Other Connections.
• Check whether the app still works. An invalid token causes API requests to return HTTP status code 401 Unauthorized.Verify: Look at whether the app shows errors.
• Check the token type the app uses. Apps that call APIs not requiring your permission use app access tokens.Verify: Review whether the app ever asked you to authorize it.

How Twitch handles this

• Twitch APIs use OAuth 2.0 access tokens to access resources.
• Access tokens, refresh tokens, and client secrets should be treated like a password and safeguarded.
• Access and refresh tokens can become invalid if the token expires or if the user disconnects the app.
• Third-party apps that call the Twitch APIs and maintain an OAuth session must call the /validate endpoint to verify the access token is still valid.

Which path applies to you?

1. Did you disconnect the app from your Connections settings? Disconnecting the app invalidates its token.
2. Is the app still making requests after disconnecting? An invalid token causes its API requests to return HTTP status code 401 Unauthorized.
3. Did you only change your password? Access and refresh tokens can become invalid if the user changes their password.
4. Do you want to confirm the token's state directly? An app maintaining an OAuth session must call the /validate endpoint to verify the access token is still valid.

Step by step: finding the cause

1. Check your current connections. Review whether the app is still listed in your account connections.Confirm: Check whether the app's name still appears under Other Connections.
2. Disconnect the app if it is still listed. Access and refresh tokens can become invalid if you disconnect the app.Where: /settings/connectionsConfirm: Check that the app no longer appears in the list.
3. Give the token time to be checked. An app that maintains an OAuth session is required to call the /validate endpoint to verify the access token is still valid.Confirm: Check whether the app's behaviour changes after some time has passed.
4. Look at what the app does when it fails. If the token is invalid, its API requests return HTTP status code 401 Unauthorized.Confirm: Check any error messages or logs the app shows you.
5. Identify the token type involved. Apps calling APIs that don't require your permission use app access tokens rather than user access tokens.Confirm: Check whether the app ever asked you to authorize it initially.
6. Decide whether a new token must be requested. When a token becomes invalid, a new access token must be obtained using the appropriate flow for the app.Confirm: Check whether the app prompts you to reauthorize it.

Common mistakes

• Assuming a password change ends every connection. Tokens can become invalid if the user changes their password.Why it happens: Access and refresh tokens can become invalid if the user changes their password.
• Never actually disconnecting the app. A token can become invalid if the user disconnects the app from the Connections page.Why it happens: Disconnecting requires going to the account's /settings/connections page and clicking Disconnect next to the app's name.
• Expecting instant failure after disconnecting. An app maintaining an OAuth session must call the /validate endpoint to verify the token is still valid.Why it happens: Apps that maintain an OAuth session must call the /validate endpoint to verify the token is still valid.

Quick reference

Keeping track of who has access