[Beyonder]

When making requests to twitch, we make calls to this URL:
https://gql.twitch.tv/gql

With example post data:
[{"operationName":"FollowButton_FollowUser","variables":{"input":{"disableNotifications":false,"targetID":"12345678"}},"extensions":{"persistedQuery":{"version":1,"sha256Hash":"3efee1acda90efdff9fef6e6b4a29213be3ee490781c5b54469717b6121ffdfe"}}}]

Does anyone know what the SHA256Hash is?
I was wondering if it could be Unix timestamp or does anyone have any other suggestions ?

Thanks in advance🤩

[Xora]

A hash takes in any kind of data (strings, numbers, etc.) and converts it into a unique series of 32-bytes (for the 256 SHA, meaning 256 bits which is 32 bytes).

If you change a single number of character in the original data and hash it again, you will get a very different number.

It is used to check, for example, if a piece of data was corrupted.

[Beyonder]

A hash takes in any kind of data (strings, numbers, etc.) and converts it into a unique series of 32-bytes (for the 256 SHA, meaning 256 bits which is 32 bytes).

If you change a single number of character in the original data and hash it again, you will get a very different number.

It is used to check, for example, if a piece of data was corrupted.

Yes I know what a hash is.
I am wondering if anyone knows what data twitch stores in the SHA256 hash in requests made to their API. ✌

[Xora]

Yes I know what a hash is.
I am wondering if anyone knows what data twitch stores in the SHA256 hash in requests made to their API. ✌

No clue, bro, not gonna lie...

[Beyonder]

No clue, bro, not gonna lie...

Its all good man, thanks anyways ✌

[MavenGradle]

That is an undocumented API that can essentially get you banned for using it. The official API documentation is located here:
https://dev.twitch.tv/docs/

I would recommend that, if you're making a commercial application, that you do not use the GraphQL API endpoint since it is in violation of the Twitch TOS:
https://discuss.dev.twitch.tv/t/is-it-le...nt/21811/5

vi. delete, remove, circumvent, disable, damage, or otherwise interfere with (a) security-related features of the Twitch Services or User Content, (b) features that prevent or restrict use or copying of any content accessible through the Twitch Services, © features that enforce limitations on the use of the Twitch Services or User Content, or (d) the copyright or other proprietary rights notices on the Twitch Services or User Content;

vii. reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code of the Twitch Services or any part thereof, except and only to the extent that this activity is expressly permitted by the law of your jurisdiction of residence;

https://www.twitch.tv/p/en-gb/legal/terms-of-service/

3. Limitations. You must comply with all instructions and requirements in any integration documents, guidelines, policies, or other documentation that we provide or make available to you. You will not reverse engineer, disassemble or decompile the Program Materials or otherwise compromises Twitch’s rights in the Program Materials. You will not take any action related to the Program Materials that interferes with, damages, or accesses or uses in any unauthorized manner the hardware, software, networks, technologies or other properties or services of Twitch or of any end user, mobile operator or other third party. You will not use the Program Materials with any software or other materials that are subject to licenses or restrictions (e.g., open source software licenses) that, when combined with the Program Materials, would require Twitch to disclose, license, distribute or otherwise make all or any part of such Program Materials available to anyone. You will not remove, modify, or obscure any copyright, patent, trademark or other proprietary or attribution notices on or in any Program Materials. All licenses granted to you in this Agreement are conditional on your continued compliance with this Agreement, and will immediately and automatically terminate if you do not comply with any term or condition of this Agreement.

https://www.twitch.tv/p/en-gb/legal/deve...agreement/

[Beyonder]

That is an undocumented API that can essentially get you banned for using it. The official API documentation is located here:
https://dev.twitch.tv/docs/

I would recommend that, if you're making a commercial application, that you do not use the GraphQL API endpoint since it is in violation of the Twitch TOS:
https://discuss.dev.twitch.tv/t/is-it-le...nt/21811/5

https://www.twitch.tv/p/en-gb/legal/terms-of-service/

https://www.twitch.tv/p/en-gb/legal/deve...agreement/

I knew that already and I did not intend to makea commercial application 😁
But thank you anyways ✌

[pointandlaugh]

I suspect it's probably the payload hash with a nonce so you can pick up on tampering maybe? UNIX timestamp hash wouldn't tell you much, it's unlikely to be a user token, and I'd like to think that the Twitch backend applications are probably stateless which means it's probably not a session ID hash.

[flatline]

Did you try making a POST without the hash or an incorrect hash? Might give some clues (shot in the dark really)

My guess is session ID or API key

[Beyonder]

I suspect it's probably the payload hash with a nonce so you can pick up on tampering maybe? UNIX timestamp hash wouldn't tell you much, it's unlikely to be a user token, and I'd like to think that the Twitch backend applications are probably stateless which means it's probably not a session ID hash.

Thank you for the info.

---

Did you try making a POST without the hash or an incorrect hash? Might give some clues (shot in the dark really)

My guess is session ID or API key

I will do it again later and post the information here.
I have seen others re-create the request, so I know its possible(Anything is?🙃)

[iolaka]

It's not a Unix timestamp.

I'll give you a hint,

[Beyonder]

It's not a Unix timestamp.

I'll give you a hint,

I love a challenge 🤩✌

[SomeoneBadass]

Did you figure it out @Beyonder? I'm in a similar boat- and trying to get data from the gql api. I can't seem to figure out what the hash is, and it's honest to goodness the last thing.