Choose the correct principal #
| Context | Identity | Mutation protection |
|---|---|---|
| Website player / creator | API-host application or website-player session | Allowed website Origin, session CSRF and resource ownership |
| Native Twitch viewer | Linked Twitch Extension JWT; viewer and channel verified | Cookie-free Authorization plus exact approved Extension Origin |
| Raiderville viewer | Room-bound website authorization and session access grant | Website Origin/CSRF, room access and movement lease |
| OBS overlay | Separate revocable read-only bearer | Read-only scope; creator cookie alone does not authorize it |
Website sign-in #
Account-only sign-in requests identity without creating a streamer community. Creator onboarding may establish the creator's own community. Both use browser-bound, single-use OAuth state and the registered application callback.
Production API cookies are host-only, HttpOnly, Secure and SameSite=Lax. Keep credentials on the API origin and fetch with credentials only where the existing website client does. Read CSRF from the current authenticated session response. A community link never grants creator administration.
Conflicting creator/player accounts return409 rather than mixing identities. An expired session should show a usable sign-in destination, not silently reuse stale identity.
Native Extension identity #
Use Twitch's Extension helper and its authorized viewer/channel context. Creator OAuth cookies, Helix access tokens and standalone browser preview choices are not Extension viewer identity. The server checks the signed JWT, linked viewer, time claims and broadcaster channel, then resolves that channel's community.
The ext.communityraiders.com preview is a nonpersistent design workspace. It does not sign a user in or authorize writes. A packaged panel is also distinct from an installed or Twitch-approved Extension.
Never create a fake viewer JWT or development-login bypass in a public build. Request additional real platform access through the approved operator flow.
Expiry and logout #
Default maximum website session duration is12hours, capped by the verified token expiry. Twitch validation runs periodically; invalid identities cannot keep using their old authorization. Logout ends the relevant application session. It is not a complete account-deletion or Twitch-disconnection implementation.
Do not log OAuth query strings, private overlay URLs, CSRF/session values or credential material. Developer examples in these docs use placeholders only.