Security

Authorize only on Kick. Client secrets stay on the server after submission; results are browser-bound and available once. This site uses state, PKCE S256, CSRF checks, rate limits and no-store responses. Never publish tokens, client secrets or private retrieval URLs.

Tokens belong to their issuing application. Refresh requires that application’s credentials, or this site’s enabled shared-app refresh service. Select only needed permissions, protect stream keys, and revoke tokens you no longer need.