<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Redirect URL in Spotify for Developers</title>
    <link>https://community.spotify.com/t5/Spotify-for-Developers/Redirect-URL/m-p/7057128#M18467</link>
    <description>&lt;P&gt;Hi &lt;a href="https://community.spotify.com/t5/user/viewprofilepage/user-id/26908795"&gt;@Zaura&lt;/a&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Thank you for asking in the Spotify Community, and Welcome!&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I understand you want to know what a redirect URI is. Here is an explanation:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P data-start="96" data-end="320"&gt;A &lt;A href="https://developer.spotify.com/documentation/web-api/concepts/redirect_uri" target="_blank" rel="noopener"&gt;&lt;STRONG data-start="98" data-end="114"&gt;redirect URI&lt;/STRONG&gt;&lt;/A&gt; is the URL Spotify uses to send users back to your app after they approve or deny access. It's a required part of the &lt;A href="https://developer.spotify.com/documentation/web-api/tutorials/code-flow" target="_blank" rel="noopener"&gt;&lt;STRONG data-start="233" data-end="260"&gt;Authorization Code Flow&lt;/STRONG&gt;&lt;/A&gt; and must be registered in your Spotify Developer Dashboard.&lt;/P&gt;
&lt;H3 data-start="322" data-end="352"&gt;Redirect URI Requirements:&lt;/H3&gt;
&lt;UL data-start="353" data-end="864"&gt;
&lt;LI data-start="353" data-end="498"&gt;
&lt;P data-start="355" data-end="498"&gt;&lt;STRONG data-start="355" data-end="373"&gt;Must use HTTPS&lt;/STRONG&gt;, unless you're using a loopback address like &lt;CODE data-start="419" data-end="442"&gt;&lt;A href="http://127.0.0.1:PORT" target="_blank" rel="noopener"&gt;http://127.0.0.1:PORT&lt;/A&gt;&lt;/CODE&gt; or &lt;CODE data-start="446" data-end="465"&gt;http://[::1]:PORT&lt;/CODE&gt;. &lt;STRONG data-start="467" data-end="497"&gt;&lt;CODE data-start="469" data-end="480"&gt;localhost&lt;/CODE&gt; is not allowed&lt;/STRONG&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="499" data-end="605"&gt;
&lt;P data-start="501" data-end="605"&gt;The redirect URI must &lt;STRONG data-start="523" data-end="540"&gt;exactly match&lt;/STRONG&gt; what you registered — including case, slashes, and port numbers.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="606" data-end="742"&gt;
&lt;P data-start="608" data-end="742"&gt;&lt;STRONG data-start="608" data-end="630"&gt;Custom URI schemes&lt;/STRONG&gt; are supported, but HTTPS is recommended. For mobile apps, use &lt;STRONG data-start="693" data-end="714"&gt;Android App Links&lt;/STRONG&gt; or &lt;STRONG data-start="718" data-end="741"&gt;iOS Universal Links&lt;/STRONG&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="743" data-end="864"&gt;
&lt;P data-start="745" data-end="864"&gt;Starting &lt;STRONG data-start="754" data-end="771"&gt;April 9, 2025&lt;/STRONG&gt;, these stricter rules apply to all new apps. Existing apps must comply by &lt;STRONG data-start="846" data-end="863"&gt;November 2025&lt;/STRONG&gt;. You can read more information about this change on &lt;A href="https://developer.spotify.com/blog/2025-02-12-increasing-the-security-requirements-for-integrating-with-spotify" target="_blank" rel="noopener"&gt;this page&lt;/A&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;/UL&gt;
&lt;P data-start="866" data-end="881"&gt;&lt;STRONG data-start="866" data-end="878"&gt;Examples&lt;/STRONG&gt;:&lt;/P&gt;
&lt;UL data-start="882" data-end="951"&gt;
&lt;LI data-start="882" data-end="916"&gt;
&lt;P data-start="884" data-end="916"&gt;&lt;CODE data-start="884" data-end="914"&gt;&lt;A href="https://example.com/callback" target="_blank" rel="noopener"&gt;https://example.com/callback&lt;/A&gt;&lt;/CODE&gt;&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="917" data-end="951"&gt;
&lt;P data-start="919" data-end="951"&gt;&lt;CODE data-start="919" data-end="951"&gt;&lt;A href="http://127.0.0.1:8000/callback" target="_blank" rel="noopener"&gt;http://127.0.0.1:8000/callback&lt;/A&gt;&lt;/CODE&gt;&lt;/P&gt;
&lt;/LI&gt;
&lt;/UL&gt;
&lt;H3 data-start="953" data-end="997"&gt;How It Works in &lt;A href="https://developer.spotify.com/documentation/web-api/tutorials/code-flow" target="_blank" rel="noopener"&gt;Authorization Code Flow&lt;/A&gt;:&lt;/H3&gt;
&lt;OL data-start="998" data-end="1481"&gt;
&lt;LI data-start="998" data-end="1104"&gt;
&lt;P data-start="1001" data-end="1104"&gt;Your app directs the user to Spotify’s &lt;CODE data-start="1040" data-end="1052"&gt;/authorize&lt;/CODE&gt; endpoint, including your registered &lt;CODE data-start="1089" data-end="1103"&gt;redirect_uri&lt;/CODE&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="1105" data-end="1355"&gt;
&lt;P data-start="1108" data-end="1187"&gt;After the user accepts or denies, Spotify redirects them back to that URI with:&lt;/P&gt;
&lt;UL data-start="1191" data-end="1355"&gt;
&lt;LI data-start="1191" data-end="1221"&gt;
&lt;P data-start="1193" data-end="1221"&gt;a &lt;CODE data-start="1195" data-end="1201"&gt;code&lt;/CODE&gt; (if successful), or&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="1225" data-end="1270"&gt;
&lt;P data-start="1227" data-end="1270"&gt;an &lt;CODE data-start="1230" data-end="1237"&gt;error&lt;/CODE&gt; parameter (if denied or failed).&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="1274" data-end="1355"&gt;
&lt;P data-start="1276" data-end="1355"&gt;You should also validate the &lt;CODE data-start="1305" data-end="1312"&gt;state&lt;/CODE&gt; parameter to protect against CSRF attacks.&lt;/P&gt;
&lt;/LI&gt;
&lt;/UL&gt;
&lt;/LI&gt;
&lt;LI data-start="1356" data-end="1481"&gt;
&lt;P data-start="1359" data-end="1481"&gt;Your app then sends a POST request to &lt;CODE data-start="1397" data-end="1409"&gt;/api/token&lt;/CODE&gt; with the &lt;CODE data-start="1419" data-end="1425"&gt;code&lt;/CODE&gt; and the &lt;STRONG data-start="1434" data-end="1457"&gt;same &lt;CODE data-start="1441" data-end="1455"&gt;redirect_uri&lt;/CODE&gt;&lt;/STRONG&gt; to get an access token.&lt;/P&gt;
&lt;/LI&gt;
&lt;/OL&gt;
&lt;P data-start="1483" data-end="1620" data-is-last-node="" data-is-only-node=""&gt;If your app can't securely store a client secret (e.g., mobile or SPA), use the &lt;A href="https://developer.spotify.com/documentation/web-api/tutorials/code-pkce-flow" target="_blank" rel="noopener"&gt;&lt;STRONG data-start="1563" data-end="1600"&gt;Authorization Code with PKCE Flow&lt;/STRONG&gt;&lt;/A&gt; for added security.&lt;/P&gt;
&lt;P data-start="1483" data-end="1620" data-is-last-node="" data-is-only-node=""&gt;&amp;nbsp;&lt;/P&gt;
&lt;P data-start="1483" data-end="1620" data-is-last-node="" data-is-only-node=""&gt;I hope this helps. Feel free to ask more help.&lt;/P&gt;</description>
    <pubDate>Sat, 19 Jul 2025 07:23:50 GMT</pubDate>
    <dc:creator>Ximzend</dc:creator>
    <dc:date>2025-07-19T07:23:50Z</dc:date>
    <item>
      <title>Redirect URL</title>
      <link>https://community.spotify.com/t5/Spotify-for-Developers/Redirect-URL/m-p/7056490#M18464</link>
      <description>&lt;P&gt;I am creating a new application and I would like to know what kind of redirect URL they are looking for&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;My Question or Issue&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;I want to know about the how to create the redirect URL&lt;/P&gt;</description>
      <pubDate>Fri, 18 Jul 2025 17:02:40 GMT</pubDate>
      <guid>https://community.spotify.com/t5/Spotify-for-Developers/Redirect-URL/m-p/7056490#M18464</guid>
      <dc:creator>Zaura</dc:creator>
      <dc:date>2025-07-18T17:02:40Z</dc:date>
    </item>
    <item>
      <title>Re: Redirect URL</title>
      <link>https://community.spotify.com/t5/Spotify-for-Developers/Redirect-URL/m-p/7057128#M18467</link>
      <description>&lt;P&gt;Hi &lt;a href="https://community.spotify.com/t5/user/viewprofilepage/user-id/26908795"&gt;@Zaura&lt;/a&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Thank you for asking in the Spotify Community, and Welcome!&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I understand you want to know what a redirect URI is. Here is an explanation:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P data-start="96" data-end="320"&gt;A &lt;A href="https://developer.spotify.com/documentation/web-api/concepts/redirect_uri" target="_blank" rel="noopener"&gt;&lt;STRONG data-start="98" data-end="114"&gt;redirect URI&lt;/STRONG&gt;&lt;/A&gt; is the URL Spotify uses to send users back to your app after they approve or deny access. It's a required part of the &lt;A href="https://developer.spotify.com/documentation/web-api/tutorials/code-flow" target="_blank" rel="noopener"&gt;&lt;STRONG data-start="233" data-end="260"&gt;Authorization Code Flow&lt;/STRONG&gt;&lt;/A&gt; and must be registered in your Spotify Developer Dashboard.&lt;/P&gt;
&lt;H3 data-start="322" data-end="352"&gt;Redirect URI Requirements:&lt;/H3&gt;
&lt;UL data-start="353" data-end="864"&gt;
&lt;LI data-start="353" data-end="498"&gt;
&lt;P data-start="355" data-end="498"&gt;&lt;STRONG data-start="355" data-end="373"&gt;Must use HTTPS&lt;/STRONG&gt;, unless you're using a loopback address like &lt;CODE data-start="419" data-end="442"&gt;&lt;A href="http://127.0.0.1:PORT" target="_blank" rel="noopener"&gt;http://127.0.0.1:PORT&lt;/A&gt;&lt;/CODE&gt; or &lt;CODE data-start="446" data-end="465"&gt;http://[::1]:PORT&lt;/CODE&gt;. &lt;STRONG data-start="467" data-end="497"&gt;&lt;CODE data-start="469" data-end="480"&gt;localhost&lt;/CODE&gt; is not allowed&lt;/STRONG&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="499" data-end="605"&gt;
&lt;P data-start="501" data-end="605"&gt;The redirect URI must &lt;STRONG data-start="523" data-end="540"&gt;exactly match&lt;/STRONG&gt; what you registered — including case, slashes, and port numbers.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="606" data-end="742"&gt;
&lt;P data-start="608" data-end="742"&gt;&lt;STRONG data-start="608" data-end="630"&gt;Custom URI schemes&lt;/STRONG&gt; are supported, but HTTPS is recommended. For mobile apps, use &lt;STRONG data-start="693" data-end="714"&gt;Android App Links&lt;/STRONG&gt; or &lt;STRONG data-start="718" data-end="741"&gt;iOS Universal Links&lt;/STRONG&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="743" data-end="864"&gt;
&lt;P data-start="745" data-end="864"&gt;Starting &lt;STRONG data-start="754" data-end="771"&gt;April 9, 2025&lt;/STRONG&gt;, these stricter rules apply to all new apps. Existing apps must comply by &lt;STRONG data-start="846" data-end="863"&gt;November 2025&lt;/STRONG&gt;. You can read more information about this change on &lt;A href="https://developer.spotify.com/blog/2025-02-12-increasing-the-security-requirements-for-integrating-with-spotify" target="_blank" rel="noopener"&gt;this page&lt;/A&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;/UL&gt;
&lt;P data-start="866" data-end="881"&gt;&lt;STRONG data-start="866" data-end="878"&gt;Examples&lt;/STRONG&gt;:&lt;/P&gt;
&lt;UL data-start="882" data-end="951"&gt;
&lt;LI data-start="882" data-end="916"&gt;
&lt;P data-start="884" data-end="916"&gt;&lt;CODE data-start="884" data-end="914"&gt;&lt;A href="https://example.com/callback" target="_blank" rel="noopener"&gt;https://example.com/callback&lt;/A&gt;&lt;/CODE&gt;&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="917" data-end="951"&gt;
&lt;P data-start="919" data-end="951"&gt;&lt;CODE data-start="919" data-end="951"&gt;&lt;A href="http://127.0.0.1:8000/callback" target="_blank" rel="noopener"&gt;http://127.0.0.1:8000/callback&lt;/A&gt;&lt;/CODE&gt;&lt;/P&gt;
&lt;/LI&gt;
&lt;/UL&gt;
&lt;H3 data-start="953" data-end="997"&gt;How It Works in &lt;A href="https://developer.spotify.com/documentation/web-api/tutorials/code-flow" target="_blank" rel="noopener"&gt;Authorization Code Flow&lt;/A&gt;:&lt;/H3&gt;
&lt;OL data-start="998" data-end="1481"&gt;
&lt;LI data-start="998" data-end="1104"&gt;
&lt;P data-start="1001" data-end="1104"&gt;Your app directs the user to Spotify’s &lt;CODE data-start="1040" data-end="1052"&gt;/authorize&lt;/CODE&gt; endpoint, including your registered &lt;CODE data-start="1089" data-end="1103"&gt;redirect_uri&lt;/CODE&gt;.&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="1105" data-end="1355"&gt;
&lt;P data-start="1108" data-end="1187"&gt;After the user accepts or denies, Spotify redirects them back to that URI with:&lt;/P&gt;
&lt;UL data-start="1191" data-end="1355"&gt;
&lt;LI data-start="1191" data-end="1221"&gt;
&lt;P data-start="1193" data-end="1221"&gt;a &lt;CODE data-start="1195" data-end="1201"&gt;code&lt;/CODE&gt; (if successful), or&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="1225" data-end="1270"&gt;
&lt;P data-start="1227" data-end="1270"&gt;an &lt;CODE data-start="1230" data-end="1237"&gt;error&lt;/CODE&gt; parameter (if denied or failed).&lt;/P&gt;
&lt;/LI&gt;
&lt;LI data-start="1274" data-end="1355"&gt;
&lt;P data-start="1276" data-end="1355"&gt;You should also validate the &lt;CODE data-start="1305" data-end="1312"&gt;state&lt;/CODE&gt; parameter to protect against CSRF attacks.&lt;/P&gt;
&lt;/LI&gt;
&lt;/UL&gt;
&lt;/LI&gt;
&lt;LI data-start="1356" data-end="1481"&gt;
&lt;P data-start="1359" data-end="1481"&gt;Your app then sends a POST request to &lt;CODE data-start="1397" data-end="1409"&gt;/api/token&lt;/CODE&gt; with the &lt;CODE data-start="1419" data-end="1425"&gt;code&lt;/CODE&gt; and the &lt;STRONG data-start="1434" data-end="1457"&gt;same &lt;CODE data-start="1441" data-end="1455"&gt;redirect_uri&lt;/CODE&gt;&lt;/STRONG&gt; to get an access token.&lt;/P&gt;
&lt;/LI&gt;
&lt;/OL&gt;
&lt;P data-start="1483" data-end="1620" data-is-last-node="" data-is-only-node=""&gt;If your app can't securely store a client secret (e.g., mobile or SPA), use the &lt;A href="https://developer.spotify.com/documentation/web-api/tutorials/code-pkce-flow" target="_blank" rel="noopener"&gt;&lt;STRONG data-start="1563" data-end="1600"&gt;Authorization Code with PKCE Flow&lt;/STRONG&gt;&lt;/A&gt; for added security.&lt;/P&gt;
&lt;P data-start="1483" data-end="1620" data-is-last-node="" data-is-only-node=""&gt;&amp;nbsp;&lt;/P&gt;
&lt;P data-start="1483" data-end="1620" data-is-last-node="" data-is-only-node=""&gt;I hope this helps. Feel free to ask more help.&lt;/P&gt;</description>
      <pubDate>Sat, 19 Jul 2025 07:23:50 GMT</pubDate>
      <guid>https://community.spotify.com/t5/Spotify-for-Developers/Redirect-URL/m-p/7057128#M18467</guid>
      <dc:creator>Ximzend</dc:creator>
      <dc:date>2025-07-19T07:23:50Z</dc:date>
    </item>
  </channel>
</rss>

