Twitch API returning 403 with Authorization and Client ID?

Question

I'm trying to list active Twitch streams from a Game ID.

My code goes as follows:

$ch = curl_init();
$URL = 'https://api.twitch.tv/helix/streams?game_id=3412';
$X = [
    'Authorization: Bearer {Client Secret}',
    'Client-ID: {Client ID}',
];
curl_setopt($ch, CURLOPT_URL, $URL);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, $X);

$result = curl_exec($ch);

The result should be streams for Grand Theft Auto III, however the response I get is this:

object(stdClass)[121]
  public 'error' => string 'Unauthorized' (length=12)
  public 'status' => int 401
  public 'message' => string 'Invalid OAuth token' (length=19)

I've generated a new secret and verified my Client ID was correct. I've been following this documentation: https://dev.twitch.tv/docs/api/reference#get-streams

Scratching my head over here, I've done this before on the old API. I've found various people with the same problem, but not able to replicate any of their solutions. Anyone have any idea? Thanks.

Answer 1

You need to get an authorization token, which is separate from the client secret, for use in the Authorization header. Client credentials flow is the easiest of the three supported and fitting for backend API calls that aren't done on behalf of any particular user.