LiveSticky makes outbound HTTP requests to the following external domains (all declared and locked inside the Devvit security configuration devvit.json):
| Domain | Purpose |
|---|---|
id.twitch.tv | Twitch OAuth 2.0 token endpoint. Used to obtain short-lived App Access Tokens via Client Credentials flows. |
api.twitch.tv | Twitch Helix REST API. Used to poll Twitch live status (/streams), metadata, and clips (/clips). |
youtube.googleapis.com | YouTube Data API v3. Used to resolve channel handles and poll live streams. |
id.kick.com | Kick OAuth 2.0 token endpoint. Used to obtain short-lived Kick access tokens. |
api.kick.com | Kick public API. Used to poll Kick channel stream status and game categories. |
static-cdn.jtvnw.net | Twitch static image CDN. Used to fetch Twitch channel profile avatars and offline banners. |
yt3.googleusercontent.com | YouTube user image CDN. Used to fetch YouTube channel profile avatars. |
i.ytimg.com | YouTube image CDN. Used to fetch YouTube stream thumbnails. |
files.kick.com | Kick files CDN. Used to fetch Kick channel profile avatars and stream thumbnails. |
i.redd.it | Reddit static image CDN. Used to load images uploaded directly to Reddit. |
Every request above is authenticated with credentials a moderator enters in Subreddit Settings. Those settings are readable by any moderator who can access your subreddit's app settings, which is how per-subreddit settings work on Devvit for every app. All three are read-only credentials for public data and cannot post, moderate, or reach anything private. See Who can see your API credentials for the detail and for how to rotate them.