WordPress中PHP调用Twitch Get Clips API报错：无效scope‘clips:read’

问题概述 #

在WordPress中运行PHP短代码实现Twitch剪辑展示功能时，获取access token环节返回HTTP 400错误，响应内容为：

{"status":400,"message":"invalid scope requested: ‘clips:read’"}

错误原因 #

1. 权限类型不匹配：clips:read是Twitch的用户级权限，而当前代码使用的client_credentials（客户端凭证）授权流仅支持请求应用级权限，无法申请用户级权限。
2. 冗余权限请求：Twitch Helix API获取公开的主播剪辑数据不需要clips:read权限，客户端凭证流本身即可访问这类公开资源。

修复方案 #

直接移除请求access token时的scope参数，客户端凭证流不需要指定用户级权限。

修改后的完整代码 #

function display_twitch_videos($atts) {
    // Retrieve your client ID and client secret from your Twitch app
    $clientID = 'xxxxxxxxx';
    $clientSecret = 'xxxxxxxxx';

    // Twitch API endpoint for obtaining an access token using client credentials
    $tokenUrl = 'https://id.twitch.tv/oauth2/token';

    // Parameters for the token request - 移除无效的scope参数
    $params = [
        'client_id' => $clientID,
        'client_secret' => $clientSecret,
        'grant_type' => 'client_credentials',
    ];

    // Initialize cURL session for the token request
    $ch = curl_init($tokenUrl);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

    // Execute the token request
    $response = curl_exec($ch);

    // Check for cURL errors
    if (curl_errno($ch)) {
        return 'cURL error: ' . curl_error($ch);
    }

    // Check HTTP response code
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    if ($httpCode !== 200) {
        return "Failed to obtain access token. HTTP response code: $httpCode. Response: $response";
    }

    curl_close($ch);

    // Decode the JSON response
    $tokenData = json_decode($response, true);

    // Check if access token is obtained successfully
    if (isset($tokenData['access_token'])) {
        // Use the access token in your API requests
        $accessToken = $tokenData['access_token'];

        // Use the obtained access token to make the actual API request
        $broadcasterUserId = 'xxxxxxx'; // Replace with the broadcaster's user ID
        $videoClipsUrl = "https://api.twitch.tv/helix/clips?broadcaster_id=$broadcasterUserId";

        $headers = [
            'Authorization: Bearer ' . $accessToken,
            'Client-Id: ' . $clientID,
        ];

        // Initialize cURL session for the API request
        $ch = curl_init($videoClipsUrl);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

        // Execute the API request
        $response = curl_exec($ch);

        // Check for cURL errors
        if (curl_errno($ch)) {
            return 'cURL error: ' . curl_error($ch);
        }

        // Check HTTP response code
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if ($httpCode !== 200) {
            return "Failed to retrieve video clips. HTTP response code: $httpCode. Response: $response";
        }

        curl_close($ch);

        // Decode the JSON response for video clips
        $videoClipsData = json_decode($response, true);

        // Output the result
        ob_start(); // Start output buffering
        print_r($videoClipsData); // You can customize this output
        $output = ob_get_clean(); // Get the buffered content

        return $output;
    } else {
        // Handle the case where the access token is not obtained successfully
        return 'Failed to obtain access token. Twitch API response: ' . print_r($tokenData, true);
    }
}

add_shortcode('twitch_videos', 'display_twitch_videos');

额外说明 #

如果后续需要访问非公开的用户剪辑数据，才需要使用授权码流（Authorization Code Flow）获取包含clips:read权限的用户级token，但当前场景下完全不需要。

内容的提问来源于stack exchange，提问作者Ahad Elimb