topic Re: INVALID_CLIENT: Insecure redirect URI, using custom URI in Spotify for Developers

INVALID_CLIENT: Insecure redirect URI, using custom URI

Cbooch13 — Mon, 14 Apr 2025 16:29:57 GMT

Plan

Premium

Country

Device

Samsung S20 FE

Operating System

Android

My Question or Issue

Hello everyone,

I am new to the spotify API and I am trying to complete the Oauth authorization flow for my android application. After my app redirects me to the spotify login page, I login, and it redirects me to a page that says "INVALID_CLIENT: Insecure redirect URI", it does NOT say "INVALID_CLIENT: Invalid redirect URI" which makes me believe it is a security issue. I am using a custom redirect URI, let's call it "com.myapp://callback". I have added this exactly to the redirect URI of my spotify dashboard for this project, and have verified that I wrote this exactly everywhere else in my project that required a redirect URI.

If anyone has any insight on this then I'd really appreciate it. I feel that it has something to do with spotify's new redirect URI security requirements, but I thought that those didn't apply to custom URIs for mobile apps and I'd appreciate any insight.

EDIT:
I have tested my application with a client id from a spotify project that I had created before April 9th (the date of the Spotify rules being enforced), and the application worked perfectly. This leads me to believe that it is an issue with the new redirect URI rules and how custom URIs are handled for mobile applications.

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Cbooch13 — Mon, 14 Apr 2025 15:00:08 GMT

EDIT: Added my comment to the above question.

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

hedenborn89 — Tue, 15 Apr 2025 21:29:13 GMT

i fixed it by using "https://httpbin.org/anything" as redirect_uri and it works. i was able to create my token and also refresh tokens.

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Richard_Yang — Wed, 16 Apr 2025 03:31:38 GMT

Im also having the same issue with a project of mine. API is returning insecure redirect URI with blank page instead of redirecting me to my app

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

gregggreg — Fri, 18 Apr 2025 17:37:02 GMT

I can confirm this issue. I created a new project and putting in a redirect to my app using a custom URL scheme results in an Insecure redirect URI. But if I use an older project with a previously working custom URL redirect, it works fine.

I even have an issue that I want to change the existing redirect URL for the older project and adding a new callback using a different URL scheme for that older project also fails to work.

It seems like they forgot about custom URL schemes in apps while adding this new "security" restriction. Maybe not surprising after all of the layoffs and de-emphasis on partner integrations.

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Iccyan21 — Tue, 22 Apr 2025 02:09:39 GMT

I get the exact same symptom error. Now they have to develop the project using the project I created in the past. I hope this crazy error will be fixed soon. But it's been more than 10 days since April 9 for the first time, so it should be resolved, but it's not yet.

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

BojackH — Tue, 22 Apr 2025 03:09:22 GMT

Their iOS SDK Demo apps are having issues : Spotify automatically close and the connection is refused. They really need to fix this! It's impossible to create a new app for the mobile SDK's right now. It ain't working.

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Iccyan21 — Wed, 30 Apr 2025 09:36:29 GMT

The API has been modified and is now usable!

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Hassanj99 — Fri, 02 May 2025 07:09:23 GMT

bro i am having same issue please can anyone resolve it ? i am creating an spotify clone using api and in spotify redirect url i have setup this https://localhost:3000/callback i am using mkcert for https and their certificate but after login and it showing me this in screen INVALID_CLIENT: Insecure redirect URI any solution ? please

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Socrapop — Fri, 02 May 2025 07:48:39 GMT

I had the same problem, even with https:// , localhost was not supported (that was before the fix, I don't know if it's still the case). So I changed to 127.0.0.1 instead of localhost (you may have to change your server configuration). I hope this helps.
https://developer.spotify.com/documentation/web-api/tutorials/migration-insecure-redirect-uri

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Roffers — Thu, 08 May 2025 09:34:09 GMT

This worked for me. The "fix" still doesn't work though.

Thanks

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

matt-user — Sun, 11 May 2025 03:29:46 GMT

Locally this does not work with next js next-auth http://127.0.0.1:3000/api/auth/callback/spotify

However, my production deployment works with the production callback... Is there a fix for local development?

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

JoshNoe — Fri, 16 May 2025 04:19:46 GMT

Could the docs at least be updated to indicate that https://localhost is not supported?

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

huerologe — Sat, 17 May 2025 01:21:00 GMT

I have the same problem.... can't make it work when running locally

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

jishnu_ss — Mon, 19 May 2025 17:48:43 GMT

Not working locally, keep getting INVALID_CLIENT!

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

Iccyan21 — Tue, 20 May 2025 02:54:27 GMT

Spotify's documentation says it cannot be used as a localhost redirect URI.

so I don't think you can run it locally...

This URL :
https://developer.spotify.com/documentation/web-api/concepts/redirect_uri

So the only way to test it is to rent a temporary server such as Render or a development environment server...

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

postinferno — Tue, 20 May 2025 21:28:09 GMT

so you can't publish the app on the web cuz they renewed the review process, and can't even package it as a local app cuz localhost isn't allowed?!?! it's so over guys

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

ramazansancar — Sun, 28 Sep 2025 18:30:32 GMT

I'm running my projects on a device on my local network. Therefore, I can't authenticate using 127.0.0.1 or localhost. What else can I use?

Thanks

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

RaNL — Tue, 30 Sep 2025 09:07:55 GMT

Just now i have tested the api and got obstructed with the same issue.

I'm running the bridge on a openHAB (latest) docker and after some trying i checked (gave authorisation) to the following in the app on the spotify developers dashboard: Web Playback SDK. After this, my connection with the api in openHAB works perfectly!

Re: INVALID_CLIENT: Insecure redirect URI, using custom URI

ackmanx — Fri, 28 Nov 2025 03:53:47 GMT

I've had the same app for about 5 years doing auth fine. Then today I cleaned up old redirects on the Spotify dashboard _and then_ their system flagged me as having insecure redirects and the one that was working yesterday now fails.

I used the link @Socrapop posted above and changed from `http://localhost:8888` to `http://127.0.0.1:8888`. The dashboard errored out saying "something went wrong" and wouldn't let me save the changes. Looking at network activity it showed the same error.

So, I had to delete the localhost entry so only the loopback address was there and it saved. After that now, it's working fine again.