This page details how the VRChat Twitch Integration (For Worlds!) prefab pack (known as the VTI World Kit) works in tandem with the VTI Companion App in order to transmit Twitch events to the VRChat Client.
Overview
The first and probably most important thing to note is that VTI is not a modification of the VRChat client, and therefore does not break the VRChat Terms of Service, nor does it cause issues with Easy Anti-Cheat. Instead, VTI utilizes Remote String Loading and watches VRChat's Debug Log. Read on for more details.
How VTI Talks to VRChat
As previously mentioned, VTI uses Remote String Loading in UdonSharp in order to send data to the VRChat Client. The VTI Companion App will bundle up all the events that have been triggered through Twitch into it's Event Queue, and then compile said Queue into JSON.
The VTI Companion App runs a non-internet-facing websocket on port 12011 and listens for VRChat to query for the next update, at which time it will respond with the above JSON, allowing the VRChat side to load the latest Events. This is why the VTI Troubleshooting article says that turning on Allow Untrusted URLs is required, as localhost is not on the URL Whitelist.
Because of the reliance on Remote String Loading, VTI can only update the Event Queue once every 5 seconds at the fastest due to how VRChat rate-limits its usage. As this rate-limit is global, VTI will intentionally clamp the fastest update speed to 5.1 seconds to allow any other prefab that uses Remote String Loading to function.
How VRChat Talks To The Companion
At the time of writing, VRChat does not yet support OSC for anything other than Avatars. Because of this, there is only one way to send info outside of the VRChat client, and that is through its Debug Log. If one reads through their VRChat Debug Logs after using VTI, they might come across quite a few lines with the prefix [VAL]. For example:
2024.02.04 18:00:51 Log - [VAL] VTI_EVENT_RECEIVED|7ed84988-73a9-4060-8b39-3752357f3025
In this example, VTI has sent the Companion a message saying that it's acknowledged a specific event, and it will take it from here. The several other signal types can be noted by reading the logs further, but will not be discussed in this article as it is supposed to be a general overview rather than a deep dive.
To note about the prefix, "VAL" stands for "VRChat App Link", and is the moniker for the internal library that handles the intercommunication between VRChat and an application discussed in this article. At this time of writing, this library has not yet been made public, but plans are in place to do so in the future.
How VTI Connects with Twitch
The VTI Companion App connects with the Twitch through its API. Specifically, it utilizes the Implicit Grant Flow method of authentication, which has been determined to be the safest method for both the developer and the end user. Unfortunately, this means that VTI will always pop up a browser window when beginning the Twitch connection as the credentials are not stored in the VTI Companion nor any of WaffleSlapper's or Poetica Mechanica's servers. This method also does not require the developer to use a Client Secret (required by other authentication methods) which can be used to cause harm if leaked through the VTI Companion App's source code or any external service.
The VTI Companion App utilizes a customized version of the StreamingClientLibrary by SaviorXTanren, which has been modified to enable the above Implicit Grant Flow. You can view the source code for the fork here.