Kick Integration

Connect your Kick accounts to enable chat bots, channel management, and stream interaction.

Setup

Prerequisites

1. A Kick application registered at Kick Developer Portal
2. Configure your OAuth redirect URI: {server.public_url}/v1/integrations/callback/kick
3. Note your Client ID (Kick uses OAuth 2.1 with PKCE, so no client secret is needed for public clients)

OAuth 2.1 with PKCE

Kick uses OAuth 2.1 with PKCE (Proof Key for Code Exchange) for enhanced security:

• No client secret required for public clients
• Code verifier/challenge prevents authorization code interception
• More secure for web and mobile applications

Configuration

[server]
# The redirect URI is automatically built from this: {public_url}/v1/integrations/callback/kick
public_url = "https://your-domain.com"

[integrations.kick]
client_id = "your_kick_client_id"
# client_secret is optional for confidential clients
client_secret = ""

Or via environment variables:

SERVER_PUBLIC_URL=https://your-domain.com
KICK_INTEGRATION_CLIENT_ID=your_client_id
# Optional for confidential clients
KICK_INTEGRATION_CLIENT_SECRET=

Redirect URI

The OAuth redirect URI is automatically constructed from server.public_url: {server.public_url}/v1/integrations/callback/kick

Make sure to add this exact URL to your Kick application's OAuth settings.

OAuth Scopes

Channel Scopes

Scopes requested for channel (broadcaster) accounts:

Scope	Description	Required
channel:read	Read channel information	Yes
channel:write	Update channel settings	No
chat:read	Read chat messages	Yes
subscribers:read	View subscribers list	No

Bot Scopes

Scopes requested for bot accounts:

Scope	Description	Required
chat:read	Read chat messages	Yes
chat:write	Send chat messages	Yes
user:read	Read user information	Yes

PKCE Flow

Heimdall implements the PKCE flow automatically:

1. Generate code verifier: Random 43-128 character string
2. Create code challenge: SHA256 hash of verifier, base64url encoded
3. Authorization request: Include code_challenge and code_challenge_method
4. Token exchange: Include code_verifier

The implementation handles this transparently - you just click "Connect".

Chat Integration

WebSocket Connection

Kick uses WebSocket (Pusher) for real-time chat:

// Pusher configuration for Kick
const pusher = new Pusher('your_app_key', {
  cluster: 'us2',
  authEndpoint: 'https://kick.com/pusher/auth'
});

const channel = pusher.subscribe(`chatrooms.${chatroomId}`);
channel.bind('App\\Events\\ChatMessageEvent', (data) => {
  console.log('New message:', data.content);
});

Sending Messages

Messages are sent via REST API:

POST https://kick.com/api/v2/messages/send/{chatroom_id}
Authorization: Bearer {access_token}
Content-Type: application/json

{
  "content": "Hello from the bot!",
  "type": "message"
}

Rate Limits

Type	Limit
Messages	20 messages/30 seconds
API requests	Varies by endpoint

Connecting Accounts

Connect Channel Account

1. Go to Admin > Integrations
2. Click "Connect" under Kick
3. Select "Channel" as the account type
4. Sign in with your Kick broadcaster account
5. Authorize the requested permissions
6. You'll be redirected back to Heimdall

Connect Bot Account

1. Create or log into your bot's Kick account
2. Go to Admin > Integrations
3. Click "Connect" under Kick
4. Select "Bot" as the account type
5. Enter a unique bot identifier
6. Sign in with the bot's Kick account
7. Authorize the requested permissions

Token Management

Token Lifetime

• Access Token: 1 hour (automatically refreshed)
• Refresh Token: Longer validity (varies)

PKCE Tokens

With PKCE, the token exchange requires the original code verifier. Heimdall stores this securely during the OAuth flow.

Token Errors

Error	Cause	Solution
invalid_grant	Token revoked or code verifier mismatch	Disconnect and reconnect
invalid_request	Missing PKCE parameters	Internal error, contact support
unauthorized_client	Client ID not authorized	Verify app registration

Moderation

Timeout User

POST https://kick.com/api/v2/channels/{channel}/timeout
Authorization: Bearer {access_token}
Content-Type: application/json

{
  "user_id": "{user_id}",
  "duration": 600
}

Ban User

POST https://kick.com/api/v2/channels/{channel}/bans
Authorization: Bearer {access_token}
Content-Type: application/json

{
  "user_id": "{user_id}",
  "reason": "Rule violation"
}

Delete Message

DELETE https://kick.com/api/v2/messages/{message_id}
Authorization: Bearer {access_token}

Troubleshooting

"invalid_client" error

1. Verify your Client ID is correct
2. Ensure the app is properly registered on Kick
3. Check that redirect URI matches exactly

PKCE verification failed

This indicates a code verifier mismatch:

1. Session may have expired during OAuth flow
2. Try disconnecting and reconnecting
3. Clear browser cookies and retry

Chat connection drops

1. Implement reconnection logic
2. Handle Pusher connection state changes
3. Re-subscribe to channels after reconnect

Bot messages not sending

1. Verify chat:write scope was authorized
2. Check rate limits
3. Ensure bot account is not banned/muted in channel