Recent Linux client update changes (2026)

[Vasil]

Hey folks! 

This is a heads-up that there will be a new update to the Spotify Linux client signatures. The latest available client will not install this new key just yet, but it's coming soon.

Come February, you may see errors related to missing keys and failed signatures when trying to update Spotify if you haven't installed the new key. Note that it will be installed automatically starting with the upcoming client update.

Here is the updated key:

curl -sS https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.asc | sudo gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/spotify.gpg

For further instructions on how to install Spotify on Linux, check out this support page here.

Have a nice day!

[Ibraheem94]

curl -sS https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.asc | sudo gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/spotify.gpg

[Nostalgia_Realm]

I cannot possibly run this command on all the machines that I manage out there with Spotify installed on it, I manage systems Linux Mint Cinnamon and running a simple sudo apt update reveals that the public key is still incorrect at the moment.

Will it be updated automatically at some point and how will I be able know?

And, am I right to notice that other automatic system updates in Linux Mint are broken as well as long as the public key is not updated?

Because as far as I can tell, no updates are being installed as long as the public key issue is unresolved on my system.

I can confirm that Spotify will finally update when running the command in the OP. Though my question still stands..

[TPom]

Hello, I just get an failure massage. Is this key still correct? Thank you for your support

[GeekBoy03]

They key is already not valid anymore:

Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key E1096BCBFF6D418796DE78515384CE82BA52C83A, which is needed to verify signature.

---

[Jaxius]

what happened to the current song playing popup feature?

[burtek]

I wonder why spotify still uses `/etc/apt/trusted.gpg.d` and not `/etc/apt/keyrings` with `deb [signed-by=/etc/apt/keyrings/spotify.gpg]` directive ?

[Perkelix]

@burtek I already filed a ticket about that: https://community.spotify.com/t5/Desktop-Linux/Debian-packaging-could-use-some-upgrading/m-p/6820748...

[b87d_-ce745qm]

app stopped working after yesterday's update. Message saying that 'spotify cannot play this at the moment'. Already cleared cache and did a fresh app reinstall.

[pgomes]

I have updated this thread about the window decoration issue in Wayland. In summary: it should be fixed soon

[zviryatko]

hello, just thanks for last update, finally got fixed window decoration issue on wayland and which is more important for me - close to tray. Found that I didn't use spotify on pc for a few months since it was broken. 🙏

[emanemanovic]

Hi everyone,

Like many of you in this thread, I just ran into the same Sub-process /usr/bin/sqv returned an error code (1) and Missing key E1096BCBFF6D418796DE78515384CE82BA52C83A errors when trying to run sudo apt update.

While providing manual curl workarounds in this forum is helpful as a quick fix, it doesn't solve the core issue. I'd like to kindly ask the Spotify Linux engineering team to consider a permanent solution to this recurring problem.

Every time the GPG signing key for repository.spotify.com rotates/expires, it completely breaks the system-wide update process for Debian, Ubuntu, and Linux Mint users who rely on the native .deb client. This creates a lot of unnecessary frustration and forces users to hunt for the newest hash on forums to run complex CLI commands manually.

Feature Request: Automatic APT GPG key rotation

Could the Spotify team please implement an automated key rotation mechanism by shipping a dedicated keyring package? Other software vendors (like Grafana, Docker, or InfluxData) handle this seamlessly.

If you shipped a spotify-archive-keyring .deb package that installs directly to /etc/apt/keyrings/spotify.gpg, you could simply push an update to this keyring package signed with the old key a few weeks before it expires. The update would quietly place the new key on our systems in the background. When the old key finally expires and the new one takes over the repository, the new key would already be locally trusted.

This approach completely eliminates the broken apt update experience and aligns with current Debian/Ubuntu security best practices (avoiding apt-key deprecation warnings and keeping keys properly isolated).

Thanks to the devs for maintaining the Linux client (we really appreciate having it!), but please consider smoothing out this packaging workflow.

Best regards,

Jakub