OAuth and emote search questions, answered.

CPWGames Tools builds OAuth tokens and searches emotes for Twitch, Kick and Velora, with ANTISLAVE app-token support ready behind server credentials. The Twitch page uses Twitch’s implicit flow for a long-lived browser token; Kick uses OAuth 2.1 with PKCE; Velora uses PKCE and a server-side refreshable token; ANTISLAVE uses client credentials.

Each platform has its own dashboard or app-token page for scopes, renewal and revoke. Public emote search does not require an account and does not sign you in.

The token page uses a fixed basic set: channel details, chat read/write, Channel Points, subscriptions and Creator Goals, raids, bot access and emotes. Channel name and login come from the OAuth profile and do not need a separate scope.

There is no full scope picker. The catalog stays internal, so the request only contains the basic scopes this tool actually calls.

A user access token belongs to a Twitch account and acts on that account's behalf. Twitch only issues one after the account owner signs in and approves the request, so the login screen is Twitch's own.

We never see your Twitch password, and no token is generated without your approval.

The long-lived token from the Connect Twitch button is not stored by this site. Twitch returns it in the URL fragment, the page reads it, and it remains only in your browser. The URL fragment is cleared after it is read.

The separate refreshable dashboard flow stores its token server-side in a protected JSON file (storage/tokens.json by default), readable only by the web server user.

The Connect Twitch button uses Twitch's implicit grant, which returns a user access token directly to your browser. It usually lasts about 60 days, but it cannot be refreshed: when it expires or is revoked, connect again. Twitch's authorization-code flow, used by the dashboard, returns roughly four-hour tokens with a refresh token.

The long-lived token stops working and API calls return HTTP 401. It has no refresh token, so connect again to get a new one. If the token was revoked or the app was disconnected in Twitch settings, the same applies.

The dashboard's shorter authorization-code token is different: it can be refreshed with its refresh token until that refresh token is revoked or expires.

Twitch grants what the signed-in account is allowed to grant. Moderator scopes require you to actually be a moderator in the target channel (or the broadcaster), some scopes require an approved or verified application, and role-limited scopes will not stick for the wrong account.

The result page lists the granted scopes, so you can see exactly what happened.

Yes — sign in with the bot account. The basic set includes chat:read, chat:edit, user:bot and channel:bot, plus the channel scopes for points, subscriptions, goals and raids.

A token is always bound to whichever account authorized it, so a channel's token cannot act as its bot and vice versa.

Twitch's policy says an application should request only the scopes it needs, and Twitch may suspend applications that request more than required.

This tool uses a fixed basic set with no full scope picker. That keeps the request minimal; there is no need to request every scope for a normal bot.

The long-lived token is not stored by this site, so there is nothing local to delete. Remove the application manually in Twitch under Settings → Connections to revoke it.

Dashboard tokens can be revoked with the Revoke access button, which calls Twitch's /oauth2/revoke endpoint and deletes the local record immediately.

No. The site operator registers one Twitch application, and its client id and secret live in .env on the server. You just sign in.

If you self-host CPWGames Tools, create your own app at the Twitch developer console and register .../callback.php as the redirect URL.

Only into .env on the server, as TWITCH_CLIENT_SECRET. It is never rendered into HTML, never sent to the browser and should never be committed to a repository.

In the Twitch developer console, open your application and choose New secret to generate one.

The long-lived Connect flow does not send the token to the server or store it. The separate dashboard flow stores your Twitch user id, login, display name, avatar URL, email (only if granted), token pair, scope lists and timestamps.

Sessions last 14 days. Dashboard token records that have not been touched for 30 days are deleted automatically, and revoking deletes yours immediately. The privacy policy has the full detail.

Yes. The layout is responsive and the Twitch, Kick and Velora consent pages work in mobile browsers. ANTISLAVE app-token generation runs server-side. Copying a token is easier with a desktop clipboard, but the token pages always show selectable text.

No. CPWGames Tools is an independent tool and is not endorsed by or affiliated with Twitch Interactive, Inc., Amazon.com, Inc., Kick, Velora or ANTISLAVE. Platform names and marks belong to their owners.

Yes. Open the OAuth menu and choose Kick OAuth, or go directly to /authorize.php?platform=kick. Kick uses OAuth 2.1 with PKCE, state verification and a separate server-side token store.

Kick and Twitch sessions are independent. You can connect either platform, or both, from the same site.

The Kick authorization page requests user:read, channel:rewards:read, channel:rewards:write, chat:write and events:subscribe.

user:read loads your Kick profile. The rewards scopes cover Channel Points rewards, chat:write covers the chat feed, and events:subscribe covers chat, follow, subscription and gift events. Kick decides what it grants.

Kick access tokens are short-lived — commonly two hours. The refresh token is the longer-lived credential and uses a sliding 30-day window; every successful refresh resets that window.

The Kick dashboard shows the 30-day refresh token; the two-hour access token stays server-side and is refreshed automatically. If the refresh token expires or is revoked, reconnect Kick.

Kick tokens are stored separately from Twitch tokens, in a protected JSON file (storage/kick_tokens.json by default) keyed by Kick user ID.

The Kick dashboard can refresh or revoke them. The dashboard shows the refresh token; the access token remains server-side.

Yes. The server-side access token can use the scopes Kick grants with Kick’s public API. The site itself does not post chat messages or edit rewards automatically; it gives you the refresh token and a dashboard to manage it.

Treat the token as a credential and only use it in server-side code. Never put a Kick refresh token or access token in browser JavaScript or a public repository.

Twitch and Kick are live for OAuth and emote search. Velora emote search is live; Velora OAuth is marked coming soon until the app review is complete. ANTISLAVE app-token OAuth is ready behind server credentials, and ANTISLAVE emote search is marked coming soon because their API has no public emote catalogue yet.

Velora OAuth is controlled by VELORA_OAUTH_ENABLED. ANTISLAVE OAuth appears when ANTISLAVE_CLIENT_ID and ANTISLAVE_CLIENT_SECRET are set.

Not yet. ANTISLAVE exposes chat text containing emote tokens such as [emote:code], but not a public emote catalogue or image endpoint. The emote-search entry is visible and marked coming soon rather than showing incomplete data.

Velora is the newest live emote source. Twitch and Kick emote search remain available from the Emote search menu.

Velora OAuth waits for the application review; its public emote search already works. ANTISLAVE OAuth is implemented using client credentials and stays in the coming-soon state until the server has its client ID and secret.

The status cards on the home page always show which parts of each platform are live, coming soon or waiting for credentials.