403 on certain endpoints but not all, full diagnostic

morganwallendev — Tue, 10 Mar 2026 21:42:30 GMT

Plan

Free/Premium

Country

Device

(iPhone 8, Samsung Galaxy 9, Macbook Pro late 2016)

Operating System

(iOS 10, Android Oreo, Windows 10,etc.)

My Question or Issue

# Spotify Web API Support Ticket — 403 on Audio Endpoints

**Subject:** GET /audio-features and GET /audio-analysis return 403 despite valid tokens; /tracks works

**App Client ID:** `dc1da5a5d8a345e89a172867dc0b3548`

**Date:** 2026-03-10

---

## Summary

We receive `403 Forbidden` when calling the **Audio Features** and **Audio Analysis** endpoints. The response body contains only `{"error":{"status":403}}` with no `message` or `reason` field. Other catalog endpoints (e.g. `/tracks`, `/search`, `/artists`, `/albums`) return 200 OK with the same tokens.

---

## Environment

- **Use case:** Building an artist catalog tool that fetches track metadata and audio features (tempo, key, energy, danceability, etc.) for personal use

- **Authentication:** Tried both **Client Credentials** (app token) and **Authorization Code + Refresh Token** (user token) flows

- **User account:** Spotify Premium, active subscription

- **Developer Dashboard:** App configured with redirect URIs; no obvious restrictions visible

---

## What We Tried

### 1. Client Credentials flow

- Used `grant_type=client_credentials` with `client_id` and `client_secret`

- Auth succeeds, token obtained

- `/tracks/{id}` → 200 OK

- `/audio-features?ids={id}` → **403**

- `/audio-analysis/{id}` → **403**

### 2. Authorization Code + Refresh Token flow (user token)

- Used PKCE/Authorization Code to obtain refresh token

- User (Spotify Premium) authorized with scopes `user-read-private user-read-email`

- Token refresh works; access token obtained

- Same pattern: `/tracks` → 200, `/audio-features` and `/audio-analysis` → **403**

### 3. Different endpoints for comparison

| Endpoint | Method | Status |

|----------|--------|--------|

| `GET /v1/tracks/{id}` | GET | 200 OK |

| `GET /v1/audio-features?ids={id}` | GET | 403 |

| `GET /v1/audio-analysis/{id}` | GET | 403 |

---

## Response Details

The 403 response body is minimal:

```json

{

"error": {

"status": 403

}

```

No `message`, `reason`, or other fields that would explain the restriction. Response headers include standard CORS/security headers but nothing that indicates the cause.

---

## Sample Request (redacted)

```

GET https://api.spotify.com/v1/audio-features?ids=7AeM1BGYM7emrqmQn1PuWv

Authorization: Bearer [valid access token]

```

**Track used for testing:** Morgan Wallen – "I'm The Problem" (Spotify ID: `7AeM1BGYM7emrqmQn1PuWv`)

---

## Full Diagnostic Payload

A complete request/response capture (with token redacted) is attached: `spotify-403-diagnostic.json`

It includes:

- All three endpoint calls (audio-features, audio-analysis, tracks)

- Request URL, method, headers

- Response status, headers, body

- Timestamps

---

## Questions

1. **Why do these endpoints return 403** when catalog endpoints work with the same tokens?

2. **Is there a product/quota restriction** on audio-features or audio-analysis for certain app types or regions?

3. **Is Extended Quota Mode** or additional approval required for these endpoints?

4. **What can we change** (app settings, account type, request format) to successfully access audio features?

---

## References

- [Get Several Tracks' Audio Features](https://developer.spotify.com/documentation/web-api/reference/get-several-tracks-audio-features)

- [Get Track's Audio Analysis](https://developer.spotify.com/documentation/web-api/reference/get-audio-analysis)

- [Access Token](https://developer.spotify.com/documentation/web-api/concepts/access-token)

- [Refreshing Tokens](https://developer.spotify.com/documentation/web-api/tutorials/refreshing-tokens)

---

{

"summary": {

"authType": "refresh_token (user)",

"clientIdPresent": true,

"trackId": "7AeM1BGYM7emrqmQn1PuWv",

"trackName": "Morgan Wallen - More Than My Hometown"

"entries": [

{

"endpoint": "/v1/audio-features",

"url": "https://api.spotify.com/v1/audio-features?ids=7AeM1BGYM7emrqmQn1PuWv",

"method": "GET",

"requestHeaders": {

"Authorization": "Bearer [REDACTED]"

"responseStatus": 403,

"responseHeaders": {

"access-control-allow-credentials": "true",

"access-control-allow-headers": "Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token",

"access-control-allow-methods": "GET, POST, OPTIONS, PUT, DELETE, PATCH",

"access-control-allow-origin": "*",

"access-control-max-age": "604800",

"alt-svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000, h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000",

"cache-control": "private, max-age=0",

"content-encoding": "gzip",

"content-type": "application/json; charset=utf-8",

"date": "Tue, 10 Mar 2026 20:55:43 GMT",

"server": "envoy",

"strict-transport-security": "max-age=31536000",

"transfer-encoding": "chunked",

"vary": "Accept-Encoding",

"via": "HTTP/2 edgeproxy, 1.1 google",

"x-content-type-options": "nosniff"

"responseBody": "{\n \"error\" : {\n \"status\" : 403\n }\n}",

"timestamp": "2026-03-10T20:55:43.722Z"

{

"endpoint": "/v1/audio-analysis/7AeM1BGYM7emrqmQn1PuWv",

"url": "https://api.spotify.com/v1/audio-analysis/7AeM1BGYM7emrqmQn1PuWv",

"method": "GET",

"requestHeaders": {

"Authorization": "Bearer [REDACTED]"

"responseStatus": 403,

"responseHeaders": {

"access-control-allow-credentials": "true",

"access-control-allow-headers": "Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token",

"access-control-allow-methods": "GET, POST, OPTIONS, PUT, DELETE, PATCH",

"access-control-allow-origin": "*",

"access-control-max-age": "604800",

"alt-svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000, h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000",

"cache-control": "private, max-age=0",

"content-length": "25",

"content-type": "application/json; charset=utf-8",

"date": "Tue, 10 Mar 2026 20:55:43 GMT",

"server": "envoy",

"strict-transport-security": "max-age=31536000",

"via": "HTTP/2 edgeproxy, 1.1 google",

"x-content-type-options": "nosniff"

"responseBody": "{\"error\":{\"status\": 403}}",

"timestamp": "2026-03-10T20:55:43.830Z"

{

"endpoint": "/v1/tracks/7AeM1BGYM7emrqmQn1PuWv",

"url": "https://api.spotify.com/v1/tracks/7AeM1BGYM7emrqmQn1PuWv",

"method": "GET",

"requestHeaders": {

"Authorization": "Bearer [REDACTED]"

"responseStatus": 200,

"responseHeaders": {

"access-control-allow-credentials": "true",

"access-control-allow-headers": "Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token",

"access-control-allow-methods": "GET, POST, OPTIONS, PUT, DELETE, PATCH",

"access-control-allow-origin": "*",

"access-control-max-age": "604800",

"alt-svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000, h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000",

"cache-control": "public, max-age=0",

"content-encoding": "gzip",

"content-type": "application/json; charset=utf-8",

"date": "Tue, 10 Mar 2026 20:55:43 GMT",

"etag": "\"MC-ImU2NTk2ZWFjY2ZmOTk5ZTYzNGQzYTUzZWY3ZDUwNTlkIg==\"",

"server": "envoy",

"strict-transport-security": "max-age=31536000",

"transfer-encoding": "chunked",

"via": "HTTP/2 edgeproxy, 1.1 google",

"x-content-type-options": "nosniff",

"x-robots-tag": "noindex, nofollow"

"responseBody": "{\"album\":{\"album_type\":\"album\",\"artists\":[{\"external_urls\":{\"spotify\":\"https://open.spotify.com/artist/4oUHIQIBe0LHzYfvXNW4QM\"},\"href\":\"https://api.spotify.com/v1/artists/4oUHIQIBe0LHzYfvXNW4QM\",\"id\":\"4oUHIQIBe0LHzYfvXNW4QM\",\"name\":\"Morgan Wallen\",\"type\":\"artist\",\"uri\":\"spotify:artist:4oUHIQIBe0LHzYfvXNW4QM\"}],\"external_urls\":{\"spotify\":\"https://open.spotify.com/album/5IZ8sY5FjtL9hloXpv0XbD\"},\"href\":\"https://api.spotify.com/v1/albums/5IZ8sY5FjtL9hloXpv0XbD\",\"id\":\"5IZ8sY5FjtL9hloXpv0XbD\",\"images\":[{\"url\":\"https://i.scdn.co/image/ab67616d0000b27335ea219ce47813b5e2dc3745\",\"width\":640,\"height\":640},{\"url\":\"https://i.scdn.co/image/ab67616d00001e0235ea219ce47813b5e2dc3745\",\"width\":300,\"height\":300},{\"url\":\"https://i.scdn.co/image/ab67616d0000485135ea219ce47813b5e2dc3745\",\"width\":64,\"height\":64}],\"is_playable\":true,\"name\":\"I’m The Problem\",\"release_date\":\"2025-05-16\",\"release_date_precision\":\"day\",\"total_tracks\":37,\"type\":\"album\",\"uri\":\"spotify:album:5IZ8sY5FjtL9hloXpv0XbD\"},\"artists\":[{\"external_urls\":{\"spotify\":\"https://open.spotify.com/artist/4oUHIQIBe0LHzYfvXNW4QM\"},\"href\":\"https://api.spotify.com/v1/artists/4oUHIQIBe0LHzYfvXNW4QM\",\"id\":\"4oUHIQIBe0LHzYfvXNW4QM\",\"name\":\"Morgan Wallen\",\"type\":\"artist\",\"uri\":\"spotify:artist:4oUHIQIBe0LHzYfvXNW4QM\"}],\"disc_number\":1,\"duration_ms\":177811,\"explicit\":false,\"external_ids\":{\"isrc\":\"USUG12500975\"},\"external_urls\":{\"spotify\":\"https://open.spotify.com/track/7AeM1BGYM7emrqmQn1PuWv\"},\"href\":\"https://api.spotify.com/v1/tracks/7AeM1BGYM7emrqmQn1PuWv\",\"id\":\"7AeM1BGYM7emrqmQn1PuWv\",\"is_local\":false,\"is_playable\":true,\"name\":\"I'm The Problem\",\"track_number\":1,\"type\":\"track\",\"uri\":\"spotify:track:7AeM1BGYM7emrqmQn1PuWv\"}",

"timestamp": "2026-03-10T20:55:43.980Z"

}

]

}

Re: 403 on certain endpoints but not all, full diagnostic

kingosticks4 — Wed, 11 Mar 2026 00:53:31 GMT

I'm not going to read all that AI waffle. But I will remind you access to those audio endpoints was removed for newer apps, back in 2024. https://developer.spotify.com/blog/2024-11-27-changes-to-the-web-api

The endpoints are marked as deprecated in the docs, even the one you linked as a reference.

Re: 403 on certain endpoints but not all, full diagnostic

ThePodfather — Wed, 11 Mar 2026 08:55:57 GMT

Thanks for jumping in here @kingosticks4 ! Exactly right.

topic 403 on certain endpoints but not all, full diagnostic in Spotify for Developers

403 on certain endpoints but not all, full diagnostic

Re: 403 on certain endpoints but not all, full diagnostic

Re: 403 on certain endpoints but not all, full diagnostic