How to Get a Twitch API Key: Client ID and App Access Token

November 9, 2026

A Twitch API key is a Client ID plus an OAuth token. The Client ID names your app and is not secret. The token, minted with your Client Secret, proves you are allowed to call. Every Helix request needs both headers. This walkthrough follows Twitch's own docs. Twitch does not charge for API calls; see Is the Twitch API free? for what that covers.

Before you start

• A Twitch account with a verified email.
• Two-factor authentication on. Twitch's registration docs require it under Security and Privacy; refresh the console after you enable it, or registration stays locked.
• A redirect URL. Twitch's own examples use http://localhost:3000 for local work.

How to get a Twitch API key, step by step

1. Open the console. Go to dev.twitch.tv/console and log in.
2. Register an app. On the Applications tab, click Register Your Application.
3. Name it. The name must be unique among all Twitch applications, so add your company or project name.
4. Add an OAuth Redirect URL. Type it and click Add. It must match what your code sends exactly.
5. Pick a Category, tick the "I'm not a robot" box, and click Create.
6. Get your Twitch Client ID. Under Developer Applications, click Manage. Copy the Client ID.
7. Create the secret. Click New Secret and store it right away. A new secret invalidates the old one.

Twitch asks for one client ID per app; sharing one across apps can get your access suspended.

Get a Twitch app access token

For public data such as users, streams, games and clips, an app access token from the client credentials flow is enough (getting tokens):

curl -X POST "https://id.twitch.tv/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&grant_type=client_credentials"

Twitch's example answer is {"access_token":"...","expires_in":5011271,"token_type":"bearer"}. That expires_in is seconds, about 58 days in the example. There is no refresh token; you cannot refresh app access tokens, you request a new one.

Make your first Helix API request

curl "https://api.twitch.tv/helix/users?login=twitchdev" \
  -H "Authorization: Bearer YOUR_APP_TOKEN" \
  -H "Client-Id: YOUR_CLIENT_ID"

Get Users accepts up to 100 login or id values in one call and returns id, login, display_name, broadcaster_type, description, profile_image_url and created_at (API reference). Here is a Python client that validates hourly, as Twitch requires, and waits out a 429:

import os, time
import requests

CID, SECRET = os.environ["TWITCH_CLIENT_ID"], os.environ["TWITCH_CLIENT_SECRET"]
state = {"token": None, "checked": 0}

def new_token():
    r = requests.post("https://id.twitch.tv/oauth2/token", data={
        "client_id": CID, "client_secret": SECRET, "grant_type": "client_credentials",
    }, timeout=30)
    r.raise_for_status()
    state.update(token=r.json()["access_token"], checked=time.time())

def ensure_token():
    if state["token"] is None:
        return new_token()
    if time.time() - state["checked"] > 3600:  # validate hourly
        v = requests.get("https://id.twitch.tv/oauth2/validate",
                         headers={"Authorization": f"OAuth {state['token']}"}, timeout=30)
        if v.status_code == 401:
            return new_token()
        state["checked"] = time.time()

def helix(path, **params):
    while True:
        ensure_token()
        r = requests.get(f"https://api.twitch.tv/helix{path}", params=params, timeout=30,
                         headers={"Authorization": f"Bearer {state['token']}", "Client-Id": CID})
        if r.status_code == 429:
            time.sleep(max(1, int(r.headers["Ratelimit-Reset"]) - int(time.time())))
            continue
        if r.status_code == 401:
            new_token()
            continue
        r.raise_for_status()
        return r.json()["data"]

for u in helix("/users", login=["twitchdev", "twitch"]):
    print(u["login"], u["broadcaster_type"], u["created_at"])

Validate your Twitch token every hour

Twitch's validation docs say your app must validate its token when it starts and hourly after that, and Twitch may revoke keys or throttle apps that do not. Call GET https://id.twitch.tv/oauth2/validate with Authorization: OAuth TOKEN. A 200 returns client_id, scopes and expires_in; a 401 with "invalid access token" means get a new one.

App access token vs user access token

To refresh a user token, POST grant_type=refresh_token with your client_id, client_secret and the URL-encoded refresh_token to id.twitch.tv/oauth2/token. Refresh tokens from confidential clients do not expire; those from public clients, which have no secret, expire after 30 days unused (refresh docs). Tokens also die when the user changes their password or disconnects your app (authentication overview).

Twitch API rate limits

Helix uses a token bucket: each request costs 1 point by default, and app-token and user-token requests have separate buckets. Watch the Ratelimit-Limit, Ratelimit-Remaining and Ratelimit-Reset headers; Twitch's API guide shows a limit of 800 in its example. On 429, wait until Ratelimit-Reset. Lists page with the pagination.cursor value passed as after, and first sets the page size up to 100.

Common Twitch API errors

If you just need public data

Helix is free and good. What it asks of you is token handling, hourly validation and user IDs. If you only need public channel data by handle, ScrapeIO skips all of that: the Twitch profile API, Twitch user videos API, schedule API and clip transcript API, which Helix does not offer, at 1 credit a call. More detail is in Twitch API for profiles, clips and VODs and the Twitch MCP server page.

curl "https://scrapeio.com/v1/twitch/profile?handle=twitchdev" \
  -H "x-api-key: YOUR_KEY"

FAQ

How do I get a Twitch Client ID?

Register an app in the Twitch Developer Console, then click Manage under Developer Applications. The Client ID is on that page.

Is the Twitch Client ID secret?

No. Twitch says client IDs are public and can appear in a web page's source. The Client Secret must never be exposed.

Why can't I register a Twitch application?

Two-factor authentication is off, or the console was not refreshed after you turned it on. Your email must also be verified.

How long does a Twitch app access token last?

Read expires_in in the token response; Twitch's example is 5,011,271 seconds, about 58 days. Validate hourly and request a new one when it fails.

Can I refresh a Twitch app access token?

No. Twitch says app access tokens cannot be refreshed. Run the client credentials request again.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

• https://dev.twitch.tv/docs/authentication/register-app/
• https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/
• https://dev.twitch.tv/docs/authentication/
• https://dev.twitch.tv/docs/authentication/validate-tokens/
• https://dev.twitch.tv/docs/authentication/refresh-tokens/
• https://dev.twitch.tv/docs/api/guide/
• https://dev.twitch.tv/docs/api/reference/