# How Twitch Addresses Scalability and Authentication

DevFeed: [How Twitch Addresses Scalability and Authentication](<https://devfeed.tech/articles/how-twitch-addresses-scalability-and-authentication-20451.md>)

Original publisher: [Read original article](<https://medium.com/twitch-news/how-twitch-addresses-scalability-and-authentication-718d6ed3c471?source=rss----3ae745429979--engineering>)

Author: Eugene Pivovarov

Published: 2019-03-15T19:13:30Z

Content type: article

Language: en

Sources: [Twitch](<https://devfeed.tech/sources/twitch.md>)

Topics: [Twitch](<https://devfeed.tech/topics/twitch.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Scalability](<https://devfeed.tech/topics/scalability.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [identity-management](<https://devfeed.tech/tags/identity-management.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [latency](<https://devfeed.tech/tags/latency.md>), [lazy-loading](<https://devfeed.tech/tags/lazy-loading.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [scalability](<https://devfeed.tech/tags/scalability.md>), [tls](<https://devfeed.tech/tags/tls.md>), [twitch](<https://devfeed.tech/tags/twitch.md>)

## AI overview

This article explains how Twitch's Identity team addressed authentication scalability and performance. It describes reducing login-form latency through prefetching and lazy loading, and reducing downstream validation workload by exchanging OAuth 2.0 access tokens for short-lived JWTs containing user information, scopes, and a digital signature.

## Source excerpt

Curious how Twitch Identity services addresses scalability and performance challenges related to authentication? Last Tuesday, the Twitch Identity team -- which helps Twitch users create and manage their digital identity and owns the services that provide authentication, authorization, and user metadata management -- hosted a Meetup.com event to explain just that. But we're recapping here just for you! First challenge: Login form load The goal of authentication is to verify who the user is. In a typical login flow, the user supplies a password along with a username and the service validates the credentials. Login user interface The Twitch Login form used to load very slowly, as long as 10 seconds in some Asian and Pacific countries. The browser had to make a DNS request for the authentication backend, initiate a TLS connection to authentication service, make a request to load the page, and then make additional requests for more assets. Altogether, there were five round trips and over 150 KB of data transfer. To improve load latency, the team considered a few options: prefetching, connection reuse, inlining, and lazy loading. Ultimately, the solution relies mostly on prefetching by making the login modal part of the main page, but it employs lazy load for fetching heavy assets. As a result, the median load latency dropped as much as 20x from 4.1 sec to 0.2 sec. Second challenge: User session validation At the end of the login flow, the browser obtains a long-lived OAuth 2.0 access token and stores it in a cookie. This token is required for subsequent requests to the Twitch API and the corresponding downstream services. If each service had to validate the OAuth token directly against the token dispensary, the latter would need to handle calls from multiple services for every API request. To reduce the workload, the Identity team implemented an approach that employs self-contained JSON Web Tokens (JWT). Login and request flow In this approach, before forwarding the reque