Twitch: 5 reads and 1 write, one client

Channel, streams and subscribers. Every call below is available over HTTP, through the SDK and as a tool for a coding agent, with the same arguments and the same meter.

What Twitch can do here

The integration exposes 5 reads and 1 write, each with a declared input and output schema rather than a page of documentation you would have to translate. Channel, streams and subscribers.

How it authenticates

Twitch uses OAuth, so you link the account once and we hold the refresh token rather than a key you have to paste. The link is the credential: revoke it at Twitch and the calls stop here too, immediately, without anyone deleting anything on our side.

Capabilities it fulfils

Twitch answers social.profile.get in the vendor-neutral form, which means code asking for that capability can be pointed at Twitch without naming it. If it goes down, or you would rather use somebody else, that is a preference change and not a rewrite.

• getMe — read: The signed-in user. With no id or login, Helix returns the token’s own user.
• getChannel — read: A channel’s title, game and language.
• updateChannel — write: Change your stream title, category or language.
• getStreams — read: Live streams — pass your own user id to check whether you are live.
• listFollowers — read: Who follows your channel.
• listSubscribers — read: Your subscribers. Affiliate or Partner only.

Questions

Do I have to bring my own API keys?

You can, and that lane is free for ever — pass your key on the request or store it against your account, and we are one proxy hop. The paid lane is the other direction: we call 226 providers with our credentials so you never register anywhere. Both go through the same client and the same operation names.

What happens to a key I store here?

It is sealed with AES-256-GCM before it reaches the database and is only ever opened to make the call you asked for. It is scoped to your account, it is never logged, and deleting the connection deletes it. For an OAuth provider we hold a refresh token instead, and revoking the link at the provider stops the calls here immediately.

What happens when a provider changes its API?

The operation contract is declared, so a response that no longer matches is a refusal rather than a silently wrong answer. The contract does not coerce types — a field declared a number that arrives as a string is rejected at the edge, on the way in and on the way out.