INVALID_CLIENT: Insecure redirect URI

Kely_39 — Mon, 02 Jun 2025 09:17:02 GMT

Hello everyone,

I'm new to the Spotify API and I'm currently trying to complete the OAuth authorization flow for my web application. After being redirected to the Spotify login page, I log in, but instead of getting redirected to my app's callback URL, I get an error that says:

"INVALID_CLIENT: Insecure redirect URI"

It's not the usual "Invalid redirect URI" error, so I suspect it's related to a security restriction rather than a misconfiguration.

I'm using a redirect URI like this:
`http://123.45.67.89:2001/callback`
This URI is registered exactly as-is in the Spotify Developer Dashboard, and I'm using the public IP of my server, not `127.0.0.1`, because I'm not working locally.

I've double-checked the URI in the dashboard, in my code, and in the documentation — everything seems correct. Still, the error persists.

I’ve also noticed that other developers seem to be encountering this issue recently, so I’m wondering if it could be related to recent changes on Spotify’s side?

I would really appreciate any help or workaround — even a temporary solution for development purposes — as I need to have a working version of my project ready within the next few weeks.

Thanks in advance for your help!

Re: INVALID_CLIENT: Insecure redirect URI

LambertSpot — Tue, 17 Jun 2025 11:19:44 GMT

I believe it is because you are using http instead of https, from documentation on Redirect URI:

Use HTTPS for your redirect URI, unless you are using a loopback address, when HTTP is permitted.

The public IP of your server is not a loopback address I believe.

topic INVALID_CLIENT: Insecure redirect URI in Spotify for Developers

INVALID_CLIENT: Insecure redirect URI

Re: INVALID_CLIENT: Insecure redirect URI