Authentication

Complete OAuth 2.0 support with authorization code exchange, client credentials, and refresh token flows.

TwitchAuth provides complete OAuth 2.0 support including authorization code exchange, client credentials, and refresh token flows with built-in caching and refresh leeway.

import { TwitchAuth } from "velho";

const auth = new TwitchAuth({
  clientId: "...",
  clientSecret: "...",
  refreshLeewaySeconds: 120,
});

// App access token (client credentials flow)
const appToken = await auth.getAppAccessToken(["channel:read:subscriptions"]);

// User access token from refresh token
const userToken = await auth.getUserAccessToken({ refreshToken: "..." });

// Exchange authorization code for tokens (OAuth 2.0 authorization code flow)
const newUserToken = await auth.exchangeAuthorizationCode({
  code: "authorization_code_from_callback",
  redirectUri: "http://localhost:3000/auth/callback",
});

Complete OAuth 2.0 support: authorization code exchange, client credentials, and refresh token flows.
Tokens cache per scope (app) or refresh token (user) until they are near expiry.
forceRefresh bypasses the cache when a token is known to be invalid.
Inject fetchFn in tests or when overriding Bun's global fetch implementation.