topic Re: Oauth sign in to web api without web browser / graphical interface in Spotify for Developers

Oauth sign in to web api without web browser / graphical interface

mci — Sun, 24 Dec 2023 17:31:28 GMT

I'm working on the alarm clock with Spotify playlists and albums. I wrote a client (https://github.com/ciembor/spotify-cmd) based on a Spotify Web API and it works well, but when I Connect using oauth it opens browser and then uses my callback. The problem is I will have no graphical interface nor browser in the Raspberry. There will be very basic Raspbian with no X windows. What to do in such case? It musi be reliable solution, once I install it on Raspbian it should connect to Spotify API without any user activity for years and be reliable. After all it's an alarm clock.

Plan

Premium

Device

RaspberryPi / any computer

Operating System

Linux / osx / bsd

My Question or Issue

Re: Oauth sign in to web api without web browser / graphical interface

Ximzend — Thu, 21 Nov 2024 12:46:32 GMT

You can do the authentication at your computer, and copy the final Access Token and Refresh Token into a file. Your program then only needs to access the tokens in that file, and refresh them when they expire. If the API does not return a new one, you can reuse the old refresh token.

https://developer.spotify.com/documentation/web-api/concepts/authorization

https://developer.spotify.com/documentation/web-api/tutorials/refreshing-tokens

Note: You can Not use the Client Credentials flow for this.

Re: Oauth sign in to web api without web browser / graphical interface

IgorM1 — Thu, 21 Nov 2024 12:42:29 GMT

I was searching for the answer for some time for my own purposes, and you man helped me very well, I have no idea why I even did not think about storing the token. Perhaps due to security reason, but I realized that without your login cookies the token itself does not give anybody anything serious.

What I noticed is that Spotify from time to time (once a week?) returns you a page with "Would you like to allow this app to have an access to your personal data?" and "Agree" button. In my case it is completely okay, I redirect user to browser, but for the guy above sounds like deal breaker.