topic Re: Authorization Code Flow from stand-alone application in Spotify for Developers

Authorization Code Flow from stand-alone application

umeshberry — Wed, 28 Sep 2022 23:38:12 GMT

I want to play tracks for a user from a stand-alone application on a Windows computer. This application is written in Java. There doesn't appear to be a way to do the Authorization Code Flow for a user for this configuration. It looks like that can only be done from content hosted in a browser. Is that correct?

I can do the Client Credentials Flow but that does not authenticate a user and hence I cannot play a track for the user with that.

Plan

Premium

Country

Device

Laptop

Operating System

Windows 10

Re: Authorization Code Flow from stand-alone application

Peter_Schorn — Sun, 02 Oct 2022 23:14:37 GMT

You can implement the authorization code flow from any application. You will need to open the authorization URL in the browser, but you can register a custom URL scheme for your Windows application (you'll have to do your own research on how to do this) so that Spotify redirects to your application after the user accepts your authorization request.

Re: Authorization Code Flow from stand-alone application

umeshberry — Tue, 04 Oct 2022 12:24:48 GMT

Thanks. If I understand correctly, in response to the first API request, a browser is needed to display scopes and allow users to authorize the app. Subsequently, using what you suggest, the remaining steps (receiving the code, requesting tokens) can be done in the standalone app. This helps improve the user experience, but it is still not seamless. Ideally, the app would request authorization and the user would authorize from within the app without switching to a browser.

Is the browser requirement due to security? I am a newbie when it comes to security... can anyone provide insight on if that is the case and why?

Re: Authorization Code Flow from stand-alone application

Peter_Schorn — Tue, 04 Oct 2022 16:56:01 GMT

If I understand correctly, in response to the first API request, a browser is needed to display scopes and allow users to authorize the app. Subsequently, using what you suggest, the remaining steps (receiving the code, requesting tokens) can be done in the standalone app.

Yes, this is correct.

Is the browser requirement due to security?

Yes. Your app shouldn't have access to the Spotify user's username and password, so they need to login to their account in the browser. This process only needs to be done once. After that, you can refresh the access token as many times as you want.

Re: Authorization Code Flow from stand-alone application

umeshberry — Tue, 04 Oct 2022 18:44:35 GMT

Got it. Thanks.