Everything an AI agent can do with the Twitch API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints23
API versionHelix
Last updated23 June 2026
Orientation

How the Twitch API works.

The Twitch API is how an app or AI agent works with a Twitch channel: reading who is live, updating a channel's title and category, sending a message into chat, creating channel point rewards, or moderating viewers. Access is granted through an OAuth 2.0 access token, where an app token reaches public data and a user token carries scopes that set which of a channel owner's actions a call can take. Twitch can also push a notification the moment something happens on a channel through EventSub, so an integration learns about activity without polling.

23Endpoints
7Capability groups
12Read
11Write
10Permissions
Authentication
Twitch uses OAuth 2.0. Every request sends two headers: an Authorization Bearer access token and a Client-Id naming the registered app. There are two token types. An app access token, from the client-credentials flow, reaches public data such as streams and games. A user access token, from the authorization-code flow, acts on behalf of a Twitch user and carries the scopes that user granted.
Permissions
Scopes are granular and verb-shaped, like channel:manage:broadcast to edit channel info, chat:edit to send chat, moderator:manage:banned_users to ban, and channel:read:subscriptions to read subscribers. A read scope (channel:read:...) only reads; a manage scope (channel:manage:...) writes. Public endpoints such as Get Users or Get Streams need only an app token and Client-Id, no scope at all.
Events
EventSub is the push system. An integration subscribes to an event type, like stream.online or channel.follow, and Twitch sends a notification when it fires, delivered over a webhook callback (app token), a WebSocket connection (user token), or a conduit. Each event type has its own version, and many require a scope from the affected channel.
Data model
The Helix API is REST over JSON at one host, with predictable /helix/ paths. Most responses wrap results in a data array, and lists page forward with a cursor returned in a pagination object. There is no dated API version to pin; Helix is continuously updated, and only EventSub event types carry version numbers.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Twitch determines what it can reach. There is a route for making calls and a route for receiving events, and each is governed by the access token behind it and the scopes that token carries.

Ways to connect

Helix REST API

The Helix REST API takes and returns JSON at https://api.twitch.tv/helix, and pages through lists with a cursor returned in a pagination object. Every call sends an Authorization Bearer access token and a Client-Id header naming the app. Read-only public endpoints accept an app access token; endpoints that act for a channel owner need a user access token carrying the right scope.

Best forConnecting an app or AI agent to Twitch.
Governed byThe access token and the scopes it carries.
Docs ↗

EventSub

EventSub is how Twitch pushes live events to an integration. After subscribing to an event type, Twitch sends a notification when it fires, over a webhook callback on HTTPS port 443 (using an app access token and a secret Twitch verifies first), a WebSocket connection (using a user access token), or a conduit. Each event type carries its own version, and many require a scope from the affected channel.

Best forReceiving live Twitch events at an app or AI agent.
Governed byThe token type for the transport, plus any scope the event type requires.
Docs ↗
Authentication

App access token

An app access token is obtained through the OAuth 2.0 client-credentials flow using the app's client id and secret. It identifies the app, not a user, and reaches public data such as streams, users, games, and clips. It is also required for EventSub webhook transport. It carries no user scopes and cannot act on a specific channel owner's behalf.

TokenOAuth 2.0 app access token (Bearer)
Best forReading public data and EventSub webhook subscriptions.
Docs ↗

User access token

A user access token is obtained through the OAuth 2.0 authorization-code flow, where a Twitch user signs in and approves the scopes the app requested. It acts on behalf of that user and carries only the granted scopes, so it is required for anything tied to a channel owner, like editing channel info, sending chat, managing channel points, or moderating. WebSocket EventSub also uses a user token.

TokenOAuth 2.0 user access token (Bearer) with granted scopes
Best forActing on behalf of a channel owner with scoped permissions.
Docs ↗
Capability map

What an AI agent can do on Twitch.

The Twitch API is split into areas an agent can act on, like channel info, streams, chat, channel points, moderation, and live event subscriptions. Each area has its own methods, and some, like banning a viewer or sending a chat message, act on a live broadcast in front of an audience.

Endpoint reference

Every Twitch API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Users & Channels

Methods for reading user accounts and reading or editing a channel's broadcast settings.3

No scope required; an app access token and Client-Id are enough. A user token with user:read:email also returns the user's email.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope required; an app or user access token works.

Acts onchannel
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with channel:manage:broadcast from the channel owner.

Acts onchannel
Permission (capability)channel:manage:broadcast
VersionAvailable since the API’s base version
Webhook eventchannel.update
Rate limitStandard limits apply

Streams, Videos & Clips

Methods for reading live streams, past videos, and clips, and creating a clip.4

No scope required; an app or user access token works. Only currently live channels are returned.

Acts onstream
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope required; an app or user access token works.

Acts onvideo
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope required; an app or user access token works.

Acts onclip
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with clips:edit. The broadcaster must be live.

Acts onclip
Permission (capability)clips:edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Chat

Methods for sending messages, reading the viewer list, and posting announcements in chat.3

A user access token needs user:write:chat. An app access token also needs user:bot from the sending user and either channel:bot from the channel or moderator status.

Acts onchat_message
Permission (capability)user:write:chat
VersionAvailable since the API’s base version
Webhook eventchannel.chat.message
Rate limitStandard limits apply

Requires a user access token with moderator:read:chatters from the broadcaster or one of the channel's moderators.

Acts onchatter
Permission (capability)moderator:read:chatters
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with moderator:manage:announcements from the broadcaster or a moderator.

Acts onannouncement
Permission (capability)moderator:manage:announcements
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Channel Points

Methods for creating, reading, updating, and deleting custom channel point rewards.4

Requires a user access token with channel:read:redemptions or channel:manage:redemptions from the broadcaster.

Acts oncustom_reward
Permission (capability)channel:read:redemptions
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with channel:manage:redemptions. Only rewards the app created can later be updated or deleted by it.

Acts oncustom_reward
Permission (capability)channel:manage:redemptions
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with channel:manage:redemptions. The app can only update rewards it created.

Acts oncustom_reward
Permission (capability)channel:manage:redemptions
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with channel:manage:redemptions. The app can only delete rewards it created.

Acts oncustom_reward
Permission (capability)channel:manage:redemptions
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Moderation & Subscriptions

Methods for banning and unbanning viewers, reading moderators, and reading a channel's subscribers.4

Requires a user access token with channel:read:subscriptions from the broadcaster.

Acts onsubscription
Permission (capability)channel:read:subscriptions
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with moderator:manage:banned_users from the broadcaster or a moderator. Omitting a duration is a permanent ban; a duration is a timeout.

Acts onban
Permission (capability)moderator:manage:banned_users
VersionAvailable since the API’s base version
Webhook eventchannel.ban
Rate limitStandard limits apply

Requires a user access token with moderator:manage:banned_users from the broadcaster or a moderator.

Acts onban
Permission (capability)moderator:manage:banned_users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Requires a user access token with moderation:read or channel:manage:moderators from the broadcaster.

Acts onmoderator
Permission (capability)moderation:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Games & Categories

Methods for looking up games and categories and reading the most-watched games.2

No scope required; an app or user access token works.

Acts ongame
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope required; an app or user access token works.

Acts ongame
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

EventSub

Methods for creating, listing, and deleting live event subscriptions.3

Token type depends on transport: webhook needs an app access token, WebSocket needs a user access token. The scope, if any, is set by the chosen event type, not this endpoint.

Acts oneventsub_subscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Uses the same token type as the subscriptions it lists; no extra scope of its own.

Acts oneventsub_subscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Uses the same token type as the subscription being deleted; no extra scope of its own.

Acts oneventsub_subscription
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Twitch can notify an app the moment something happens on a channel, like a stream going live or a new follow, through EventSub. An integration subscribes to the events it cares about and receives a notification when each one fires, so it learns about activity without polling.

EventWhat it signalsTriggered by
stream.onlineA broadcaster started a stream. The notification carries the broadcaster and stream type.In-app only
stream.offlineA broadcaster stopped a stream and went offline.In-app only
channel.updateA channel's metadata changed, like its title, category, language, or content labels./helix/channels
channel.followA user followed a channel. Subscribing requires the moderator:read:followers scope.In-app only
channel.chat.messageA message was sent to a channel's chat room. Subscribing requires the user:read:chat scope from the chatting user./helix/chat/messages
channel.banA viewer was banned or timed out from a channel. Subscribing requires the channel:moderate scope./helix/moderation/bans
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Twitch limits how fast an app can call using a points-per-minute model, where most requests cost one point and the response carries headers showing how many points are left.

Request rate

Twitch meters requests with a token-bucket model rather than a fixed requests-per-second cap. An app is given a bucket of points, and each endpoint costs a points value, by default one point per request. App access and user access tokens have separate buckets. Every response carries Ratelimit-Limit (the bucket size, commonly 800), Ratelimit-Remaining (points left), and Ratelimit-Reset (a Unix timestamp when the bucket refills). Going over returns HTTP 429 Too Many Requests; some endpoints also return 429 for their own per-endpoint limits, signalled in the error message.

Pagination

Most list endpoints are cursor-based. A response includes a pagination object holding a cursor, and the next page is fetched by passing that cursor in the after query parameter. The first parameter sets the page size. When there are no more results the pagination object comes back empty.

Request size

The first query parameter sets how many items a page returns, with a documented maximum that varies by endpoint (commonly 100). EventSub allows up to 300 enabled subscriptions per WebSocket connection.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe request was malformed, like a missing required query parameter or an invalid body. The JSON response carries error, status, and message fields naming the problem.Read the message field, fix the parameters or body, and resend. The request is not retryable as-is.
401UnauthorizedThe access token is missing, expired, or invalid; the Client-Id header is missing or does not match the token; or a user token lacks the scope the endpoint requires.Send both an Authorization Bearer token and a matching Client-Id, refresh an expired token, or have the user re-authorize with the missing scope.
403ForbiddenThe token is valid but not permitted for this action, for example a moderation call by a user who is not the broadcaster or a moderator of the channel.Use a token from a user who has the required role on the channel, or request the action against a channel the user controls.
404Not FoundThe requested resource does not exist, like an unknown user id, channel, or subscription.Verify the id or login passed in the query and confirm the resource exists.
429Too Many RequestsThe app exhausted its points bucket, or hit a per-endpoint limit. The Ratelimit-Reset header gives a Unix timestamp for when the bucket refills.Back off until Ratelimit-Reset, then retry, and smooth the request rate to stay within Ratelimit-Limit.
500Internal Server ErrorAn error on Twitch's side. It is uncommon.Retry with exponential backoff. If it persists, check the Twitch developer forums or status page.
Versioning & freshness

Version history.

Twitch does not put a dated version number on the Helix API. It is a single, continuously updated API, while each EventSub event type carries its own version number that is pinned when an integration subscribes.

Version history

What changed, and when

Latest versionHelix
HelixCurrent version
Current API (Helix)

Helix is Twitch's current API, REST over JSON, and it carries no dated or numbered API-wide version; it is continuously updated. Versioning applies only to EventSub, where each event type has its own version pinned at subscription time. The older v5 (Kraken) API was retired.

What changed
  • Helix is the single supported Twitch API; v5 (Kraken) was shut down.
  • EventSub event types are versioned individually (for example channel.follow is version 2).
2025-05-19Feature update
Shared chat default for app-token chat messages

When using an app access token to send chat, messages by default are delivered only to the source channel named by broadcaster_id, rather than across a shared chat session.

What changed
  • Send Chat Message with an app access token defaults to the source channel only.
2024-06-17Feature update
Twitch Chat on EventSub, Send Chat Message API, and Conduit transport

Twitch added the channel.chat.message EventSub subscription for reading chat, a Helix endpoint for sending chat messages, and the Conduit transport method for EventSub, as a managed path off legacy IRC chat.

What changed
  • New channel.chat.message EventSub subscription type for reading chat.
  • New Send Chat Message Helix endpoint (POST /helix/chat/messages).
  • New Conduit transport for EventSub, alongside webhook and WebSocket.
2023-09-12Requires migration
Get Users Follows endpoint removed

The legacy /helix/users/follows endpoint was shut down and replaced by Get Channel Followers and Get Followed Channels, which use new scopes.

What changed
  • GET /helix/users/follows removed.
  • Replaced by Get Channel Followers and Get Followed Channels.

There is no API-wide version to pin; pin the version of each EventSub event type instead.

Twitch API changelog ↗
Questions

Twitch API, answered.

What's the difference between an app access token and a user access token?+
An app access token comes from the client-credentials flow and identifies the app itself; it reaches public data like streams, users, games, and clips, and is required for EventSub webhook transport. A user access token comes from the authorization-code flow, acts on behalf of a specific Twitch user, and carries the scopes that user granted, so it is needed for anything tied to a channel owner, like editing channel info, sending chat, or moderating.
Why does my request fail with a 401 even though my token is valid?+
Every Helix request needs two headers, not one: the Authorization Bearer token and a Client-Id that matches the app the token was issued to. A missing or mismatched Client-Id returns 401. A 401 also occurs when a user token is missing the scope an endpoint requires, in which case the user must re-authorize with that scope added.
How do scopes work on Twitch?+
A scope is a named permission a user grants during authorization, and it is verb-shaped: channel:read:subscriptions reads a channel's subscribers, channel:manage:broadcast edits its title and category, moderator:manage:banned_users bans and unbans. Read scopes only read; manage scopes also write. A user token only carries the scopes that were requested and approved, and an endpoint returns 401 if its required scope is absent.
How does an app receive live events from Twitch?+
Through EventSub. An integration creates a subscription naming an event type (like stream.online or channel.follow) and a transport: a webhook callback over HTTPS on port 443, which must use an app access token and a secret Twitch verifies before sending events; a WebSocket connection, which uses a user access token; or a conduit. Twitch then sends a notification each time the event fires.
How does rate limiting work?+
Twitch uses a token bucket. An app holds a bucket of points and each request costs points (one by default), refilling over time. App and user tokens have separate buckets. The Ratelimit-Limit, Ratelimit-Remaining, and Ratelimit-Reset response headers show the bucket size, points left, and when it refills. Exceeding it returns HTTP 429, and some endpoints enforce their own extra limits.
Does the Twitch API have version numbers?+
The current Helix API is not dated or numbered; it is a single, continuously updated API, and the older v5 (Kraken) API was retired. Versioning shows up only in EventSub: each event type has its own version (for example channel.follow is version 2), pinned when an integration creates the subscription, so a new version can ship without breaking existing subscribers.
Related

More social API guides for agents

What is Bollard AI?

Control what every AI agent can do on Twitch.

Bollard AI sits between a team's AI agents and Twitch. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Twitch token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Twitch
Stream Assistant
Read stream status ResourceOffReadFull use
Send chat messages ActionOffReadFull use
Ban viewers ActionOffReadFull use
Channel points rewards ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Twitch