How We Built a Twitch-Powered Content Security System (3 Years Later, Now on PHP 8+)

TL;DR: We spent three years building a security system that uses Twitch OAuth to lock content behind subscriber and follower tiers. Now integrated with WordPress and Astra, it's production-ready and monetizing.

---

The Problem We Started With

Three years ago, we faced a challenge: how do you protect exclusive content for paying supporters without building a completely custom authentication system? Every solution felt bloated, expensive, or required maintaining a separate user database.

Then it clicked: Twitch is already our identity provider. Our audience is there. Their subscription tier is there. Follower status is there. Why build something new when we could leverage what exists?

So we built a security layer on top of Twitch OAuth that ties content access directly to subscription and follower status.

---

The Evolution: PHP 7 → PHP 8+

When we started, we were on PHP 7.4. The original system worked, but we knew we'd need modern tooling to scale.

Last year, we upgraded to PHP 8+, and it was transformative:

Why PHP 8+ Mattered

• Type declarations — We could now enforce strict types across our OAuth callbacks and credential handling
• Named arguments — WordPress option functions became clearer and less error-prone
• Match expressions — Tier logic (follower → tier1 → tier2 → tier3) became cleaner
• Nullsafe operator — Session variables and API responses handled more safely
• Performance — 20-30% faster execution on average

The upgrade also meant better security. OAuth token exchanges and password-protected credential storage benefited from PHP 8's stricter memory handling and default security flags.

---

How It Works: The Architecture

1. Twitch OAuth Flow

When a user hits your login page:

1. They click "Login with Twitch"
2. Redirect to Twitch OAuth consent screen
3. User approves access
4. Twitch redirects back with an auth code
5. We exchange the code for an access token
6. We query Twitch Helix API for:
   • User profile (username, email, profile image)
   • Subscription status (tier level: 1000, 2000, 3000)
   • Follower status

2. Session & Database Storage

We store:

• Session variables (username, display name, tier level)
• Database record (one entry per login with timestamp, IP, user agent)
• HTTP-only cookies for fallback auth

3. Content Gating

On the frontend:

IF user is admin → show ALL content
ELSE IF user has no subscription → show follower-only content
ELSE IF user is tier1 → show tier1 + follower content
ELSE IF user is tier2 → show tier1, tier2 + follower content
ELSE IF user is tier3 → show everything except admin-only posts

---

WordPress + Astra Integration

We didn't want to reinvent the wheel. Instead, we built on WordPress + Astra because:

• WordPress handles content management (posts, pages, metadata)
• Astra provides a clean, fast foundation
• Custom post type (tier-content) lets us tag each post with a tier level
• Meta boxes in the admin make tier assignment effortless

The Setup

1. Admin Settings Page — Settings → Twitch OAuth
   • Input Client ID & Secret
   • Set Redirect URI
   • Store channel owner username
   • Save broadcaster ID
2. Custom Post Type — "Tier Content" posts with tier-level meta
3. Template System — Single page template that handles all content gating

No plugin dependency hell. Just clean PHP + WordPress hooks.

---

Security: Why Twitch Is Your Friend Here

We considered rolling our own auth system. Here's why Twitch OAuth is actually more secure:

1. Offloaded Credential Storage

We never store passwords. Twitch does. We only store access tokens (short-lived, revocable).

2. HTTPS by Default

All Twitch API calls use TLS 1.2+. Your redirect URI must be HTTPS.

3. Scope-Based Permissions

We only request user:read:email and subscription data. Users see exactly what we're asking for.

4. Session Destruction on Logout

We aggressively clear:

• PHP session data
• All cookies (including WP session cookies)
• Browser cache headers
• HTTP 303 redirect (not GET-based)

5. Tier-Content Post Protection

If someone tries to access a tier-content post directly:

• Bots (Googlebot, etc.) see the full content for SEO
• Unauthenticated users get redirected to login
• Authenticated users see only their tier's content
• Admins see everything

---

The Real-World Impact: Monetization

Here's what matters: this system lets you monetize immediately.

When a Twitch viewer subscribes or follows your channel, they instantly get access to locked content on your site. No manual approval. No separate user database to maintain. No waiting period.

We've seen:

• Tier 1 subscribers access exclusive guides and early-release content
• Tier 2 subscribers unlock premium streams and behind-the-scenes footage
• Tier 3 subscribers get VIP-only posts and direct communication channels
• Followers see teaser content that encourages subscription

The conversion is automatic. Twitch's payment processing handles the business logic. We just gate the content.

---

Technical Highlights (PHP 8+)

Password-Protected Credentials

<input type="password" id="twitch_client_id" name="twitch_client_id" />
<input type="password" id="twitch_client_secret" name="twitch_client_secret" />

Both fields are now masked in the WordPress admin. No credential sprawl.

Case-Insensitive Username Matching

if (strtolower($logged_in_username) === strtolower($channel_owner)) {
    $is_admin = true;
}

Twitch usernames are lowercase in the API, but admins might enter "SolarBluSeth". We handle it.

Helper Functions (DRY)

function get_twitch_credentials() {
    return [
        'CLIENT_ID' => get_option('twitch_client_id', ''),
        'CLIENT_SECRET' => get_option('twitch_client_secret', ''),
        'REDIRECT_URI' => get_option('twitch_redirect_uri', home_url('/twlogin/')),
    ];
}

No hardcoded values. No credentials.php file sprawl. Just WordPress options.

Aggressive Logout

if (isset($_POST['logout']) && $_POST['logout'] === '1') {
    $_SESSION = [];
    session_destroy();

    $cookies_to_clear = ['sbnet_userid', 'PHPSESSID', 'wordpress_logged_in_...'];
    foreach ($cookies_to_clear as $cookie) {
        setcookie($cookie, '', time() - 3600, '/');
    }

    header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
    wp_redirect(home_url('/twlogin/'), 303);
    exit;
}

No lingering session data. No cached pages serving stale content.

---

What's Next

We're exploring:

1. Conditional email sends — Notify tier1+ subscribers of new content
2. Content analytics — Track which tiers engage with which posts
3. Tier-exclusive comments — Locked discussion threads per tier
4. API integration — Let developers build on top of this

---

For Streamers & Content Creators

If you stream on Twitch and want to monetize your site:

1. Go to Twitch Developer Console
2. Create an application
3. Set your OAuth Redirect URI to https://yoursite.com/twlogin/
4. Copy your Client ID & Secret
5. Go to WordPress Settings → Twitch OAuth
6. Fill in your credentials and channel owner username
7. Create posts, tag them with tier levels
8. Done.

Your Twitch subscriptions now gate your website content. Automatically.

---

The Three-Year Lesson

We spent three years on this because we refused to compromise on:

• Security — No shortcuts with auth
• User experience — Login should take 10 seconds
• Maintainability — No spaghetti code
• Scalability — Should handle 10K concurrent users without breaking

PHP 7 → 8+ upgrade forced us to refactor for modern standards, and the result is cleaner, faster, more secure code.

If you're a creator sitting on Twitch subs and thinking "how do I monetize my website?"—this is the answer. Twitch is your security layer. WordPress is your CMS. Astra is your theme. Put them together, and you've got a system that took us three years to perfect.

Now you can build it in a day.

---

Questions? Hit us up. We've learned a lot, and we're happy to share.

Try for youself...

Login with Twitch