\n
02 · Security

Rotate tokens. Know what breaks.

WES Alert ships two private tokens per account. Either can be regenerated at any time. This page tells you what each one does, when to rotate, and what reconnects on the other end.

If everything leaked at once

Three actions, in this order. About 30 seconds.

  1. Revoke and re-grant your Twitch OAuth. Twitch settings → Connections, find WES Alert, click Disconnect. This is the root of trust. Killing it invalidates any active WES session that re-authenticates through Twitch. Reconnect from the Dashboard after.
  2. Sign out (shared device). In the Dashboard, open the account menu (top-right) and pick Sign out (shared device). Revokes every WES Alert session on every device and walks you through the Twitch logout step so no cookie lingers on machines you no longer control.
  3. Rotate both tokens and disconnect your Stream Decks. Overlay URL and Stream Key in Settings › Security, the Stream Decks just below. See How to regenerate below for what to paste back into OBS and your HTTP tools.

Not a full leak? Skip to How to regenerate for the single-token procedure.

How to regenerate

Routine rotation, single token. The context for each token lives further down.

The dashboard, Settings tab, Security section. The numbers follow the steps below.
  1. Open the Dashboard, go to the Settings tab.
  2. Pick Security in the section list.
  3. Click Regenerate next to the token you want to rotate. The old token is killed immediately and irreversibly.
  4. Copy the new value and paste it back where it was used: the OBS Browser Source for the Overlay URL. For the Stream Key: the header line of your HTTP keys and Streamer.bot. Stream Decks connected with the WES plugin need nothing: they have their own access.
  5. Refresh the OBS Browser Source (right-click → Refresh) so it picks up the new URL.

Your tokens

Both tokens live in the Dashboard under Settings › Security. They are per-account secrets. Never share them in screenshots, exports, or clip thumbnails.

Overlay URL

Used by the OBS Browser Source. The full URL carries your license key as a path segment, which is why the Dashboard hides it by default.

If leaked: anyone with the URL can open your overlay in their own browser. Each open instance counts against your account's simultaneous-instance cap, so a few abusive viewers can saturate it. Once the cap is hit, the system stops accepting new connections, which can include your own OBS Browser Source after a restart or scene refresh.

Stream Key

Used by the WES plugin for Stream Deck, pasted once in the settings of any WES key, and by HTTP keys and tools as the Authorization header. See the Stream Deck guide.

If leaked: anyone with the key can pause your alerts, apply your profiles and post fake alerts to your overlay. This is the more dangerous of the two. Rotate immediately if you suspect a leak.

When to rotate

Don't wait for a confirmed leak. Rotate proactively in any of these cases:

  • The URL appeared in a screen share, a clip thumbnail, a screenshot you posted, or a chat message you sent.
  • You handed off the OBS profile, let a friend touch your machine, sold the PC, or returned a rental.
  • The Stream Key shows up in a screenshot of an HTTP key's settings, an exported config, a GitHub gist, a Discord channel.
  • You connected a third-party tool to either token and you no longer trust the tool.
  • Routine hygiene: rotating once or twice a year is healthy even without a specific trigger.

What breaks, what doesn't

After rotating the Overlay URL

  • Active OBS sessions disconnect. Any Browser Source still pointing at the old URL goes blank until you paste the new one.
  • The Dashboard preview keeps working. The preview iframe uses your cookie-based session, not the URL.
  • Twitch events keep arriving. EventSub is tied to your Twitch OAuth, not to the overlay URL.

After rotating the Stream Key

  • Connected Stream Decks keep working. The WES plugin has its own access since version 0.2: nothing to redo. A deck still on 0.1 shows KEY?: update the plugin, then click Connect in a key's settings.
  • HTTP keys stop working. Any key or tool configured with the old Authorization header returns 401 until you paste the new header line from the dashboard's Stream Deck tab.
  • Twitch native events keep arriving. The Stream Key only matters for your HTTP tools. Follows, subs, gifts, cheers and raids come straight from EventSub and stay online.

Sessions vs tokens

Rotating a token does not log you out of the Dashboard, and does not touch your Twitch OAuth connection. These are three separate trust surfaces:

  • Tokens (Overlay URL, Stream Key) are for machine-to-machine traffic. Rotated in Settings › Security.
  • Dashboard sessions are for your browser. Kill them from the account menu (top-right): Sign out (this device only) or Sign out (shared device) (every device + Twitch logout walkthrough, recommended if you suspect your Dashboard cookie leaked).
  • Twitch OAuth is for reading your channel's events. Revoke from Twitch settings → Connections, then reconnect from the Dashboard.

Why this order? WES Alert has no password and no separate account database. We never see your Twitch password, and there is no "WES account" sitting next to your Twitch account: your Twitch login is your WES login. We trust whoever Twitch trusts. So as long as someone is signed into Twitch on their browser with access to your channel, they can re-authenticate to WES silently on the next page load (same OAuth, same trust, new session). Revoking the Twitch OAuth grant first breaks that loop at its root. Only then does the WES logout actually stick.

Need the OBS setup?

The full Browser Source walkthrough is on /guide/setup.