Multistreaming

Streamers can link their Twitch and YouTube accounts in Settings and go live there at the same time as here, at the same quality. For a platform to be offered, the instance needs an application registered with it. You do this once, and each streamer then links their own account by signing in to the platform -- nobody types a stream key.

Whoever runs the server sets two variables per platform (see the deployment variables). A platform with neither set isn't offered; one with only one of them stops the server from starting, so a typo can't quietly hide it.

Twitch

1. Go to dev.twitch.tv/console and register an application.
2. OAuth Redirect URL: your instance's address followed by /multistream/twitch/callback, for example https://live.example/multistream/twitch/callback. It must match exactly.
3. Client type: Confidential.
4. Set VIBE_LIVE_TWITCH_CLIENT_ID and VIBE_LIVE_TWITCH_CLIENT_SECRET to the application's client ID and a new secret.

The only permission asked of streamers is reading their stream key.

YouTube

1. In the Google Cloud console, create a project and enable the YouTube Data API v3.
2. Configure the OAuth consent screen and add the https://www.googleapis.com/auth/youtube scope.
3. Create an OAuth client ID of type Web application, with the authorised redirect URI set to your instance's address followed by /multistream/youtube/callback.
4. Set VIBE_LIVE_YOUTUBE_CLIENT_ID and VIBE_LIVE_YOUTUBE_CLIENT_SECRET. Optionally set VIBE_LIVE_YOUTUBE_PRIVACY to unlisted or private (public by default).

Google classes this scope as sensitive. Until Google verifies your application, streamers see a warning when they link, and no more than 100 accounts can link. For a small instance that may be enough; to go past it, submit the application for verification from the consent screen page.

Each broadcast uses some of your project's daily YouTube API quota (10,000 units unless you ask Google for more). Creating a broadcast uses about 150 units.

Turning platforms off

Settings → Instance → Multistreaming has a switch for multistreaming as a whole and one for each platform you configured, with how many streamers have linked it.

• Off stops it at once: nobody can link it, a stream going out to it stops within seconds and its broadcast is ended there, and its chat is no longer shown. Streamers see that you turned it off. Their links are kept, so turning it back on needs nobody to link again.
• Unlink everyone removes every streamer's link to that platform and gives each access back to the platform. Use it when the links themselves must go: the platform asked, or your application's secret leaked. Streamers would have to link again.

Removing a platform's two variables takes it off the instance entirely, but its links stay in the database until unlinked.

Your privacy policy and terms

Both platforms require a public privacy policy before an app uses their APIs, and YouTube requires terms that bind users to its own. Every instance serves both, readable without signing in:

• /privacy, for example https://live.example/privacy;
• /terms, for example https://live.example/terms.

They say what this instance keeps and why. For each platform you configure, they add what that platform requires: that the instance uses its API services, its documents linked (YouTube's Terms of Service and Google's Privacy Policy among them), and where access is revoked. Set VIBE_LIVE_CONTACT to an address or a URL so people can reach you; without it, they name "the administrators" of your instance.

In Google's OAuth consent screen, use your instance's address as the application home page, /privacy as the privacy policy link and /terms as the terms of service link.

Keeping streamers' accounts safe

What a streamer grants when they link lets this instance go live on their account, so it is handled like a stream key:

• encrypted in the database (with VIBE_LIVE_DB_ENCRYPTION_KEY), and never shown on any page or in any API response or data export;
• linked, switched off and unlinked only from a signed-in browser, never with an app password;
• handed back to the platform when the streamer unlinks or their account is deleted;
• sent to the platforms only over encrypted connections.

Rotating VIBE_LIVE_DB_ENCRYPTION_KEY makes every linked account unusable. Streamers are asked to link again.