topic Re: [iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app in Spotify for Developers

[iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app

teehyen — Wed, 20 Oct 2021 06:19:23 GMT

Plan

Free/Premium

Country

Device

(iPhone 11 Pro Max)

Operating System

(iOS 14.7.1.)

My Question or Issue

Our app is using iOS Spotify SDK to manage user playlists. The app use

SPTSessionManager to authenticate the user

It is working fine in 8.6.56 but it is not working with recent Spotify app releases (8.6.68, 8.6.70)

This is the flow we are using:

- The app initiateSession:

sessionManager.initiateSession(

with: [.playlistModifyPublic, .playlistModifyPrivate, .playlistReadPrivate],

options: [.default]

)

- The Spotify app will be opened

- The Spotify called a oAuth endpoint

https://accounts.spotify.com/oauth2/v2/auth?client_id=XXXX&response_type=code&redirect_uri=XXXX&client_app_id&id_token_hint=XXXX&prompt=none&scope=playlist-read-private%20playlist-modify-public%20playlist-modify-private

- Then Spotify app give my app the deeplink like this

app://spotify/?code=XXXX

- Then inside our app we called

sessionManager.application(app, open: url, options: options)

- This called returned {"error":"invalid_request","error_description":"Invalid client secret"}

It is working when I run local server and added tokenSwapURL and tokenRefreshURL. However this is not an option for us to have a additional server.

It is also working when I force the web view authorisation by removing "spotify" out of LSApplicationQueriesSchemes. But this is not a desired UX flow.

Is there some change recently that I should be aware of? How do we fix this?

Thanks for your time.

Re: [iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app

Usama2810 — Wed, 20 Oct 2021 08:43:51 GMT

I'm also having this issue for past few days on iOS. As you have mentioned the scenarios where it works. I also found one, it also works when we login the Spotify app with Sri Lankan account. I have tried changing the country using VPN but it does not works. Only works when we use Sri Lankan account, thats weird but its happening.

Re: [iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app

teehyen — Wed, 20 Oct 2021 09:29:27 GMT

Thanks for your reply.

I aslo found another workaround, instead of using

sessionManager.application(app, open: url, options: options)

I made a call to /token with the code provided by spotify app, then pass in client_secret in the request.

This worked but storing client secret in the code is not recommended.

Re: [iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app

Usama2810 — Thu, 21 Oct 2021 06:28:43 GMT

Thats great ! But I am stuck with this issue for days now.

As you said, It is working when you run local server and added tokenSwapURL and tokenRefreshURL. However this is not an option for us to have a additional server.

Can you you please guide me, how are you running the local server for tokenSawap and refresh, because It does not hit the tokenSwap url in my app.

here is my Spotify config:

private async authenticate({

playURI,

showDialog = false,

authType,

}: AuthOptions = {}) {

const config: ApiConfig = {

clientID: id,

redirectURL: redirect,

// tokenRefreshURL: 'https://spinsapi.pixarsclients.com/public/api/v1/spotify/swap',

// tokenSwapURL: 'https://spinsapi.pixarsclients.com/public/api/v1/spotify/swap',

scopes: [ApiScope.AppRemoteControlScope],

playURI,

showDialog,

authType,

};

try {

// Go and check if things are connected

const isConnected = await remote.isConnectedAsync();

this.setState(state => ({

...state,

isConnected,

}));

// Initialize the session

const {accessToken: token} = await auth.authorize(config);

this.setState(state => ({

...state,

token,

}));

await remote.connect(token);

} catch (err) {

this.onError(err);

}

Re: [iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app

teehyen — Thu, 28 Oct 2021 00:16:09 GMT

Not sure how it works on node but for me it worked when I implemented this flow https://developer.spotify.com/documentation/general/guides/authorization/implicit-grant/
Hope it helps.