topic 403 Forbidden on PUT /v1/me/tracks and /v1/me/albums despite user-library-modify scope in Spotify for Developers

403 Forbidden on PUT /v1/me/tracks and /v1/me/albums despite user-library-modify scope

Necro-y2k — Fri, 20 Mar 2026 22:38:38 GMT

Plan
Premium

Country
Argentina

Device
PC

Operating System
Windows 10

My Question or Issue

Hi everyone,

I'm using the Authorization Code with PKCE flow on an ASP.NET Core backend.

I'm trying to save tracks and albums to my own library using:

PUT /v1/me/tracks
PUT /v1/me/albums

Both endpoints consistently return:
403 {"error": {"status": 403, "message": "Forbidden"}}

What I've verified:

The access token is valid (GET /v1/me returns 200 with my correct user data)
I have a Premium account
During the OAuth consent screen, Spotify explicitly shows permission to modify my library (albums/tracks) and I accepted it (user-library-modify)
The error is "Forbidden", not "Insufficient client scope"
Calling the endpoints directly (e.g., via PowerShell with the same token) gives the same 403
PKCE flow is correctly implemented (no client_secret used)
The app is in Development mode and my account is in the allowlist
One initial PUT request succeeded right after setup, but all subsequent write requests fail

Given that the scope seems correct but the operation is still blocked,
is this a limitation of Development mode apps?

Do I need to request Extended Quota Mode to perform write operations (like saving tracks/albums), even for my own account?

Thanks.

Re: 403 Forbidden on PUT /v1/me/tracks and /v1/me/albums despite user-library-modify scope

Necro-y2k — Fri, 20 Mar 2026 23:09:36 GMT

Solved — deprecated endpoints returning 403

After a lot of digging, the issue had nothing to do with scopes, quota mode, or the PKCE flow. The endpoints
themselves are deprecated and apparently return 403 silently instead of a proper deprecation error.

Root cause: PUT /v1/me/tracks and PUT /v1/me/albums are deprecated. Even with a valid token, correct scopes
(user-library-modify), a Premium account, and the app allowlisted — both endpoints return 403 Forbidden with no useful
message.

Fix: Migrate to the new unified endpoint:

PUT https://api.spotify.com/v1/me/library?uris=spotify%3Atrack%3A{id1},spotify%3Atrack%3A{id2},...

Key differences from the old endpoints:
- Single endpoint for both tracks and albums (use spotify:track: or spotify:album: URI prefix)
- IDs go as uris query parameter in Spotify URI format, not in the request body
- Max 40 items per request (old /me/tracks allowed 50)
- Same user-library-modify scope still required

The docs at https://developer.spotify.com/documentation/web-api/reference/save-library-items show this as the current
endpoint. The old /me/tracks and /me/albums pages are marked deprecated but the 403 they return gives no indication
that deprecation is the cause — it just looks like a permissions error.

Hope this saves someone else a few hours.