diff --git a/crates/app/obs_gateway/src/endpoints/oauth_begin.rs b/crates/app/obs_gateway/src/endpoints/oauth_begin.rs
index ff0ca8e840..a4c3c8a715 100644
--- a/crates/app/obs_gateway/src/endpoints/oauth_begin.rs
+++ b/crates/app/obs_gateway/src/endpoints/oauth_begin.rs
@@ -62,7 +62,12 @@ pub async fn oauth_begin_enroll(
 
   // TODO: Not all scopes are needed!
   let mut builder = UserTokenBuilder::new(client_id, client_secret, redirect_url)
-      .set_scopes(Scope::all())
+      .set_scopes(vec![
+        Scope::BitsRead,
+        Scope::ChannelReadSubscriptions,
+        Scope::ChatEdit,
+        Scope::ChatRead,
+      ])
       .force_verify(true);
 
   let (url, _csrf_token) = builder.generate_url();
diff --git a/crates/app/obs_gateway/src/endpoints/oauth_begin_redirect.rs b/crates/app/obs_gateway/src/endpoints/oauth_begin_redirect.rs
index 2e90635790..6db0746597 100644
--- a/crates/app/obs_gateway/src/endpoints/oauth_begin_redirect.rs
+++ b/crates/app/obs_gateway/src/endpoints/oauth_begin_redirect.rs
@@ -62,7 +62,12 @@ pub async fn oauth_begin_enroll_redirect(
 
   // TODO: Not all scopes are needed!
   let mut builder = UserTokenBuilder::new(client_id, client_secret, redirect_url)
-      .set_scopes(Scope::all())
+      .set_scopes(vec![
+        Scope::BitsRead,
+        Scope::ChannelReadSubscriptions,
+        Scope::ChatEdit,
+        Scope::ChatRead,
+      ])
       .force_verify(true);
 
   let (url, _csrf_token) = builder.generate_url();
diff --git a/crates/app/obs_gateway/src/endpoints/oauth_end.rs b/crates/app/obs_gateway/src/endpoints/oauth_end.rs
index e69de29bb2..84295ad078 100644
--- a/crates/app/obs_gateway/src/endpoints/oauth_end.rs
+++ b/crates/app/obs_gateway/src/endpoints/oauth_end.rs
@@ -0,0 +1,42 @@
+use actix_http::StatusCode;
+use actix_web::{HttpResponse, HttpRequest, web, ResponseError};
+use crate::server_state::ObsGatewayServerState;
+use http_server_common::response::response_error_helpers::to_simple_json_error;
+use std::fmt;
+use std::sync::Arc;
+
+#[derive(Debug)]
+pub enum OauthEndEnrollFromRedirectError {
+  ServerError,
+}
+
+// NB: Not using DeriveMore since Clion doesn't understand it.
+impl fmt::Display for OauthEndEnrollFromRedirectError {
+  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+    write!(f, "OauthEndEnrollFromRedirectError")
+  }
+}
+
+impl ResponseError for OauthEndEnrollFromRedirectError {
+  fn status_code(&self) -> StatusCode {
+    match *self {
+      Self::ServerError => StatusCode::INTERNAL_SERVER_ERROR,
+    }
+  }
+
+  fn error_response(&self) -> HttpResponse {
+    let error_reason = match self {
+      Self::ServerError => "server error".to_string(),
+    };
+
+    to_simple_json_error(&error_reason, self.status_code())
+  }
+}
+
+pub async fn oauth_end_enroll_from_redirect(
+  http_request: HttpRequest,
+  server_state: web::Data<Arc<ObsGatewayServerState>>
+) -> Result<HttpResponse, OauthEndEnrollFromRedirectError> {
+  Ok(HttpResponse::Ok()
+      .body("TODO"))
+}
diff --git a/crates/app/obs_gateway/src/main.rs b/crates/app/obs_gateway/src/main.rs
index b0446dea35..45c693a927 100644
--- a/crates/app/obs_gateway/src/main.rs
+++ b/crates/app/obs_gateway/src/main.rs
@@ -50,6 +50,7 @@ use twitch_oauth2::tokens::UserTokenBuilder;
 use twitch_oauth2::{AppAccessToken, Scope, TwitchToken, tokens::errors::AppAccessTokenError, ClientId, ClientSecret};
 use crate::server_state::{ObsGatewayServerState, EnvConfig, TwitchOauthSecrets};
 use crate::endpoints::oauth_begin_redirect::oauth_begin_enroll_redirect;
+use crate::endpoints::oauth_end::oauth_end_enroll_from_redirect;
 
 const DEFAULT_BIND_ADDRESS : &'static str = "0.0.0.0:54321";
 
@@ -262,6 +263,10 @@ async fn main() -> AnyhowResult<()> {
   let website_homepage_redirect =
       easyenv::get_env_string_or_default("WEBSITE_HOMEPAGE_REDIRECT", "https://vo.codes/");
 
+  let oauth_redirect_url = easyenv::get_env_string_or_default(
+    "TWITCH_OAUTH_REDIRECT_URL",
+    "http://localhost:54321/twitch/oauth_redirect");
+
   let server_state = ObsGatewayServerState {
     env_config: EnvConfig {
       num_workers,
@@ -274,7 +279,7 @@ async fn main() -> AnyhowResult<()> {
     twitch_oauth_secrets: TwitchOauthSecrets {
       client_id: secrets.app_client_id.clone(),
       client_secret: secrets.app_client_secret.clone(),
-      redirect_url: "http://localhost:54321/twitch/oauth_redirect".to_string()
+      redirect_url: oauth_redirect_url,
     },
     hostname: server_hostname,
   };
@@ -320,7 +325,7 @@ pub async fn serve(server_state: ObsGatewayServerState) -> AnyhowResult<()>
                   .route(web::head().to(|| HttpResponse::Ok()))
               )
               .service(web::resource("/oauth_redirect")
-                    .route(web::get().to(oauth_begin_enroll))
+                    .route(web::get().to(oauth_end_enroll_from_redirect))
                     .route(web::head().to(|| HttpResponse::Ok()))
               )
               .service(web::resource("/websocket")