topic Re: PKCE support and example code for iOS SDK? in Spotify for Developers

PKCE support and example code for iOS SDK?

king-sparkly — Mon, 25 Mar 2024 19:25:56 GMT

I'm trying to do authentication on my app using the iOS SDK, and authenticate hopefully using the SPTSessionManager Authorization flow, the alternative method mentioned in the iOS's SDK FAQ under "What if I need to authorize without starting playback?".

I want to use PKCE so I don't have to bundle my secret key in the app or set up a key exchange server. However, I can't find any hints on how to do this from the iOS SDK. I did find some code on GitHub that references a "SPTSessionManager" class, but that's not part of the current SDK. Can anybody point me to some sample code that will put me in the right direction?

Re: PKCE support and example code for iOS SDK?

phunden — Wed, 03 Apr 2024 09:15:30 GMT

Also curious about this, I have been experimenting with the Spotify iOS SDK and authenticating the user by using the

SPTSessionManager instead of the SPTAppRemote.

During my experimentation I have seen that I can successfully call sessionManager.renewSession and perform a token refresh to receive a new accessToken if it has expired, even though I have not setup any backend services nor set the

tokenSwapURL or tokenRefreshURL in SPTConfiguration.

This makes me suspect that PKCE authorization flow is used by the SPTSessionManager as default if no URL's are set in the configuration, is this correct?