How to revoke 3rd party app access?

[skyfoxe]

I imported all my songs from Rdio by granting access to 3rd party web apps like Mooval , now I want to stop them from SPYING on my activities.

How do we manage 3rd party application access to our account (revoke access to applications, so they can no longer access your account), something similar to the way Twitter does it, or Last.fm. 

It's misleading to have an ability to grant access with no way to revoke it. I would never have granted access to 3rd party apps if I had known that it was not possible to manage these access grants.

This actually puts me on the edge of flat out removing my Spotify account entirely because it's a huge breach of trust

I DON'T WANT to be DATA MINED BY OTHER COMPANIES and STRANGERS, Please let us remove SPYS like Google does:

[MattSuda]

Hey @skyfoxe

Unfortunately Spotify does not have a way to manage third party access.

Users can add kudos to your idea to show support:

https://community.spotify.com/t5/Live-Ideas/All-Platforms-Manage-Third-Party-Access-Permissions/idi-...

[floweringmind]

That is not a solution.

[osornios]

@floweringmind

Iti is not, but by looking at the number of kudos of that idea, I don't think people care that much about it. That's sad though, because they should.

[skyfoxe]

They deleted the Kudos, it was 175 with 4 pages of replies this morning

They are trying to bury this. Are you going to let them?

[skyfoxe]

Hmm, looks like this is a new copy of my thread here: https://community.spotify.com/t5/Live-Ideas/All-Platforms-Manage-Third-Party-Access-Permissions/idi-...

[osornios]

@skyfoxe

You have my kudos.

[wbuckley]

Added kudos and some relevant tags, plus a note as to Spotify support's absurd response to a request of revoking a third party's access.

[aklimatizer]

I could be wrong here, but since you have to grant your Spotify password to the app in question for it to function....won't changing your Spotify password deny the app access to your account?

[wbuckley]

At least for any legitimate app in the sense this is referring to, it doesn't (and shouldn't ever) directly ask for your Spotify password. This link provides the technical details if curious but the basic idea is that it triggers Spotify's Auth prompt in a new window with some data saying what it wants access to, where you log directly into Spotify itself, and then that passes a different piece of data back to the app or site saying "yes this person is ____ and you can now access what was requested with this key."

What people have an issue with is that right now that extra piece of data, the "key" to access account data possibly including the ability to make changes to followers/playlists/etc if it was requested, can't be revoked by users unless it expires on its' own. Based on my followup in one particular case, Spotify claims to be unable to revoke that access as well, which is downright dangerous. Futhermore, support suggested that I contact the third party in question to have access removed, which is reliant on the third party being well-intentioned and responsive, but also impossible according to Spotify's own documentation and developer comments since there is no way for an app/site to "give up" access once it's granted either.

Put simply: Since this is completely independent of your account details, the point of it being that you don't need to give your actual login info to a third party, changing your password has zero effect on it. Most well-designed systems for third party access to information of an account use this type of process (Facebook, Google, Twitter, etc.), but I've never seen one that you can't revoke access after it's been given which is the case here.

What truly scares me is that there are numerous video games with more secure implementations than what appears to be the case at Spotify, including one with half a million users and only one developer maintaining their API (though admittedly more are likely involved with their auth setup) which is in much better shape than this.


Edit: Added some more info on inability for a third party to give up access and on other systems which use this type of process.
Edit 2: Finished reading the docs, editing for accuracy.

[OliPicard]

This makes my blood boil. Spotify should have implimented a revoke on the account side! Not all apps are providing a way to opt out. I've decided to cancel my subscription after 6 years because this is pure madness.

[espiegel]

Please add this feature

[AppleandAndroid]

Unbelievable this isn't possible

[teddddd]

This is pretty awful implementation. I should be able to control access from my account within Spotify itself. Instead you are relying on the 3rd party have tools to revoke the access, which in my case they don't provide. If you gonna go down that road at least verify the application you are allowing to use your API provides that functionality. FIX THIS!

Snippet from your support page:
"If you would like to revoke your permissions from the third-party application, please use the tools provided by the third-party application to disconnect your Spotify account."

[Hoof_Hearted]

I deleted access by BBC iPlayer by mistake. What is the easiest way to restore it??