Oauth

Before you start, make sure you have a Blaze account on https://blaze.stream. You'll need that account to access the Developer Console, register your application, get your Client ID and Client Secret, and configure the redirect URLs Blaze should allow.

https://yourapp.com/callback
http://localhost:3000/callback   # for local development

Before redirecting a user to Blaze, collect your application credentials and have your backend generate the authorization URL. Then send the user to the returned authorization page so they can log in and approve access.

POST /bapi/oauth2/generate-auth-url HTTP/1.1
Host: blaze.stream
content-type: application/json
accept: application/json

{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "redirectUri": "https://yourapp.com/callback",
  "scopes": [
    "users.read",
    "offline.access",
    "channel.moderate",
    "users.bot"
  ]
}

{
  "url": "https://blaze.stream/oauth2/authorize?...",
  "state": "RANDOM_NONCE_VALUE",
  "codeVerifier": "PKCE_CODE_VERIFIER"
}

After the user approves access, Blaze redirects them back to your registered redirect URL with a code and state query parameter. Read the returned values and validate the state before continuing.

Blaze redirects the user back to your app

Once the user approves access, Blaze sends them back to your registered redirect URI with the values your app needs to continue the flow.

https://yourapp.com/callback?code=AUTHORIZATION_CODE&state=RANDOM_NONCE_VALUE

Read and validate the returned values

In your callback handler, read the returned code, confirm the state matches the state value returned by the auth-url generation step, and keep the stored PKCE values ready for the token exchange.

const urlParams = new URLSearchParams(window.location.search);
const code = urlParams.get("code");
const returnedState = urlParams.get("state");

if (!code) {
  throw new Error("Missing code from Blaze callback");
}

if (returnedState !== expectedState) {
  throw new Error("State mismatch");
}

Once you've validated the callback, have your backend exchange the returned authorization code for a User Access Token by sending a POST request to https://blaze.stream/bapi/oauth2/token with the stored PKCE values.

POST /bapi/oauth2/token HTTP/1.1
Host: blaze.stream
content-type: application/json
accept: application/json

{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "code": "AUTHORIZATION_CODE",
  "codeVerifier": "PKCE_CODE_VERIFIER",
  "redirectUri": "https://yourapp.com/callback",
  "grantType": "authorization_code"
}

{
  "type": "user",
  "userId": "2f4c6d9a-8e2b-4d77-9f0d-3a1b2c4d5e6f",
  "tokenType": "Bearer",
  "refreshToken": "USER_REFRESH_TOKEN",
  "accessToken": "USER_ACCESS_TOKEN",
  "expiresIn": 86400, // seconds
  "scopes": ["users.read","offline.access","channel.moderate","users.bot"]
}

Use the access token to authenticate requests to the Blaze API. Include it as a Bearer token in the Authorization header of every request.

const response = await fetch("https://api.blaze.stream/v1/users/profile", {
  headers: {
    "secret": "YOUR_CLIENT_SECRET",
    "client-id": "YOUR_CLIENT_ID",
    "authorization": "Bearer USER_ACCESS_TOKEN",
    "content-type": "application/json"
  }
});

const data = await response.json();

If an access token has expired or is no longer valid, your backend can exchange the refresh token for a fresh access token response without sending the user through the full authorization flow again. Each successful refresh invalidates the previous refresh token and returns a new refresh token that your backend should store for the next refresh request.

POST /bapi/oauth2/refresh HTTP/1.1
Host: blaze.stream
content-type: application/json
accept: application/json

{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "refreshToken": "USER_REFRESH_TOKEN"
}

{
  "tokenType": "Bearer",
  "accessToken": "USER_ACCESS_TOKEN",
  "refreshToken": "USER_REFRESH_TOKEN",
  "expiresIn": 86400, // seconds
  "scopes": ["users.read","offline.access","channel.moderate","users.bot"]
}

Before you start, make sure you have a Blaze account on https://blaze.stream. You'll need that account to access the Developer Console, register your application, get your Client ID and Client Secret, and configure the redirect URLs Blaze should allow.

https://yourapp.com/callback
http://localhost:3000/callback   # for local development

Once your application is registered, have your backend send a POST request to https://blaze.stream/bapi/oauth2/token with your Client ID, Client Secret, and grantType set to client_credentials. This generates an App Access Token for server-to-server API requests without any user login or consent step.

POST /bapi/oauth2/token HTTP/1.1
Host: blaze.stream
content-type: application/json
accept: application/json

{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "grantType": "client_credentials"
}

{
  "type": "app",
  "tokenType": "Bearer",
  "accessToken": "APP_ACCESS_TOKEN",
  "expiresIn": 604800 // seconds
}

Use the App Access Token to authenticate server-to-server requests to Blaze APIs. Include it as a Bearer token in the Authorization header of every request.

const response = await fetch("https://api.blaze.stream/v1/chats/messages", {
  headers: {
    "client-id": "YOUR_CLIENT_ID",
    "authorization": "Bearer APP_ACCESS_TOKEN",
    "content-type": "application/json"
  }
});

const data = await response.json();