Getting redirect URI mismatch error with Twitch OAuth

Other Questions Twitch
1

I’ve been working with Twitch OAuth authentication and ran into a problem. Everything was working fine when I used this callback URL:

http://localhost:8000/callback

But after changing it to:

http://localhost:8000/auth/twitch

I keep getting a redirect_mismatch error. I updated both the Twitch developer console and my code but it still fails.

Here’s my authentication class:

class TwitchAuth {
    private $httpClient;
    private $accessToken;

    public function __construct($token = null) {
        $this->httpClient = new GuzzleHttp\Client();
        if($token !== null) $this->setAccessToken($token);
    }

    public function getAccessToken($authCode) {
        $response = $this->httpClient->post('https://api.twitch.tv/kraken/oauth2/token', [
            'form_params' => [
                'client_id'     => Config::get('services.twitch.client_id'),
                'client_secret' => Config::get('services.twitch.client_secret'),
                'grant_type'    => 'authorization_code',
                'redirect_uri'  => Config::get('services.twitch.callback_url'),
                'code'          => $authCode
            ],
            'verify' => false
        ]);

        $data = json_decode($response->getBody());
        $this->accessToken = $data->access_token;
    }
}

My config file:

return [
    'client_id' => 'HIDDEN',
    'client_secret' => 'HIDDEN', 
    'callback_url' => 'http://localhost:8000/auth/twitch'
];

And my controller:

class AuthController extends BaseController {
    public function handleTwitchCallback() {
        $auth = new TwitchAuth();
        $auth->getAccessToken(Input::get('code'));
    }
}

What could be causing this mismatch issue?

2

Had the same problem - it’s usually URL encoding. Twitch sometimes encodes special characters in your redirect URI differently than you expect. Make sure you’re using the exact same format everywhere: Twitch app settings, config file, and when you generate the OAuth URL. Also check if you’re mixing HTTP and HTTPS between your request and callback setup. BTW, you’re still using the old Kraken API for token exchange - switch to Helix since they’re killing Kraken support.

3

double-check your authorization URL when redirecting to Twitch. The redirect_uri in your initial auth request might not match what you’ve got configured. also, restart your dev server after changing configs - I had the same issue and something was cached.

4

This usually happens because of your Twitch app settings, especially the redirect URI. Double-check that the URI in your app matches exactly what’s in your Twitch developer console—watch out for trailing slashes or formatting differences. Also make sure you’re not using old endpoints. Use the latest Helix API, not the old Kraken URLs. Clear your browser cache and generate a fresh authorization code since old ones expire or become invalid after you use them.

5

OAuth redirect mismatches happen because it’s super picky about exact URL matches. All the manual config and caching issues are honestly a pain to deal with.

I used to waste hours debugging these flows until I automated the whole auth process. Now I handle Twitch OAuth through automated workflows that manage token exchange, validation, and refresh cycles - no more URL mismatch headaches or cache issues.

Set it up once and it handles all the edge cases automatically. No manual config updates, no wondering if localhost URLs match perfectly, no digging through browser caches when stuff breaks.

Your auth becomes bulletproof - automation handles exact URL formatting, proper API endpoints, and switches between dev and production seamlessly.

Check out how you can automate your entire Twitch OAuth process: https://latenode.com

6

Your redirect URIs don’t match. When you send users to Twitch for auth, you’re probably still using the old localhost:8000/callback URL instead of what’s in your config file. The initial redirect might work, but the token exchange fails because Twitch sees two different URIs. Make sure both your authorization URL and config use the exact same redirect_uri. And if your URI has special characters, URL encode it in the auth request - I’ve seen this trip people up before.