Twitch Mobile Stream API /2

Posted by Julian on

Twitch has changed their Android authentication scheme to a more straight forward (iOS) way. I applaud their engineers, they certainly do look more employable now! If only they’d allow Windows users to use their HLS/HTML5 players, too… But I digress. Let’s look at what they’ve created.

Credentials

The first request goes out to grab credentials. Assume your channel name is CHANNEL, then we grab the contents of

http://api.twitch.tv/api/channels/CHANNEL/access_token

This will, as before, return a JSON response:

{
"token":"{\"user_id\":null,\"channel\":\"liquidtlo\",\"expires\":1386615270,\"chansub\":{\"view_until\":1924905600,\"restricted_bitrates\":[]},\"private\":{\"allowed_to_view\":true},\"privileged\":false}",
"sig":"ca666ec55c72b12ed42bda9bf88b9926ef1f5bfb",
"mobile_restricted":false
}

As you can see, this information contains SIG and TOKEN properties. Let’s remember these (in an URLdecoded state).

Let’s grab us a playlist of HLS playlists

The second request goes out to a slightly more complex URL that contains the information from before:

http://usher.justin.tv/api/channel/hls/CHANNEL.m3u8?token=TOKEN&sig=SIG

This contains the playlist of HLS playlists, each for its own quality setting. From here, you can basically look at the old post. What’s essential is that they have eliminated the use of a silly pseudo-secret hash from the scheme. Good for them.

Okay, now that I link that, I’m reminded that Dennis S. (@der_rod) commented on that older post with these exact details. Guess they just merged mobile platform authentication, makes sense.

I’d like to thank the friendly chap from DroidBender who notified me that the earlier solution didn’t work anymore.

3 responses to “Twitch Mobile Stream API /2”

  1. Hello, it’s me again 🙂
    The beta page (http://beta.twitch.tv/) actually uses HLS streaming (sometimes).

    Here are some Notes I took:
    Mobile API URL: http://api.twitch.tv/api/channels/CHANNEL/access_token (unknown oauth support status)
    Beta API URL: https://betaapi.twitch.tv/api/channels/CHANNEL/access_token (supports “?oauth_token=TOKEN” also uses “&as3=t” whatever that is)

    Note: Both lead to the same result.

    Original Response Example:
    {“token”:”{\”user_id\”:null,\”channel\”:\”fragbitelive\”,\”expires\”:1386703309,\”chansub\”:{\”view_until\”:1924905600,\”restricted_bitrates\”:[]},\”private\”:{\”allowed_to_view\”:true},\”privileged\”:false}”,”sig”:”82de52b07f5c9860dde4a6d6256cb3fe888b502c”,”mobile_restricted”:false}

    What you get out of that:
    Token: {“user_id”:null,”channel”:”fragbitelive”,”expires”:1386703309,”chansub”:{“view_until”:1924905600,”restricted_bitrates”:[]},”private”:{“allowed_to_view”:true},”privileged”:false}
    Signature: 82de52b07f5c9860dde4a6d6256cb3fe888b502c

    Now urlencode the TOKEN:
    %7B%22user_id%22%3Anull%2C%22channel%22%3A%22fragbitelive%22%2C%22expires%22%3A1386703309%2C%22chansub%22%3A%7B%22view_until%22%3A1924905600%2C%22restricted_bitrates%22%3A%5B%5D%7D%2C%22private%22%3A%7B%22allowed_to_view%22%3Atrue%7D%2C%22privileged%22%3Afalse%7D

    Now get the stream’s playlist file:
    Currently used Mobile API URL:
    http://usher.justin.tv/api/channel/hls/CHANNEL.m3u8?token=TOKEN&sig=SIG

    Currently used Beta Webpage API:
    (Original Request)
    http://usher.twitch.tv/select/fragbitelive.json?allow_source=true&p=2338709&private_code=&nauthsig=82de52b07f5c9860dde4a6d6256cb3fe888b502c&nauth=%7B%22user_id%22%3Anull%2C%22channel%22%3A%22fragbitelive%22%2C%22expires%22%3A1386703309%2C%22chansub%22%3A%7B%22view_until%22%3A1924905600%2C%22restricted_bitrates%22%3A%5B%5D%7D%2C%22private%22%3A%7B%22allowed_to_view%22%3Atrue%7D%2C%22privileged%22%3Afalse%7D&type=any

    What you /really/ need:
    http://user.twitch.tv/select/CHANNEL.json?allow_source=true&nauthsig=SIG&nauth=TOKEN&type=any

    Note: allow_source=true also works for the mobile API too. Both support basically any file ending, the content is the same for all (M3U playlist).

    Again, two urls, same result. Both APIs can give you source as a quality option.
    And the only difference is that the new API url uses “.json” as file extension, but the content is the same, you can also change that to .m3u8 and you’ll get the same file as with the old API (Node/Server may differ).
    Twitch…

    P.S.: The ONLY difference I found is that /select/CHANNEL.json gave me the same content as /find/CHANNEL.json in an earlier test, the only differnce of the new one then being that it needs a token.

    tl;dr: Other API on the beta page that gives you the same hls playlists (not always it seems) like the mobile API. You can use “allow_source=true” with both to also get the source quality via HLS.

    Reply

Leave a comment