API Auth using only a python script

[nikkk1]

None of the below information is required. However, the more you provide the easier it will be for us to try and help.

Plan

Not applicable

Country

Brazil

Device

Not applicable

Operating System

Not applicable

My Question or Issue

Hi, there

My name is Nikolas and I have a public, free, pip package called spotify_recommender_api, which is also on GitHub: https://github.com/nikolas-virionis/spotify-api, that basically gives the user a bunch of recommendations, within the scope of a single playlist or the users account

It has been running for a while and has a bunch of users, but in my eyes, it is really useful and I use it now and again to explore more songs myself. being the most avid user of the package

Recently Spotify took down their console for testing the endpoints freely, which is of course their right, but my package was fully based on it, because since it is only a pip package I didn't find a way to get the redirect_uri and get the auth token that way, so my package always required the user to be redirected into the console, get the auth token and give it to the script.

The problem now is that the only way I can get any permissions is with the client_credentials method which does not allow for me to get user data (all I use is most listened tracks and artists, and I scan the user library and create and update playlists, never deleting anything)

So for the past couple of days, my package has been shut down because of this problem, and since I do not profit from it in any way, shape, or form, and it is only meant to help Spotify users, including myself, I would hope there could be a way to solve this problem and still be able to continue with the package, because for me it is something amazing, and the more people it helps the more fulfilled I am. And since music is such a big part of a lot of people's mental health, helping people find whatever they are looking for is great

Anyways thanks for the help

[coniferous]

Have you looked into this? https://github.com/spotipy-dev/spotipy 

I was able to access my account with it. The docs don't say it supports PKCE authentication, but it does when you look at the code.

[Ximzend]

I use the Python module Spotipy myself, but if you don't want to use that module, you can have a look at this answer on Stack Overflow.

[nikkk1]

Thanks for responding but I don't believe I made the issue I am facing clear
My code is not, as of today, an API, just a bunch of Python code with the requests module that uses the Spotify API, and as of today, I got the Auth Token via the console, so I cannot have a redirect_uri.
From both links you shared it seems that both require the redirect_uri, for me to have the auth token in any way other than client_credentials, that is not enough, regarding the permissions I need for the package to run
Having that in mind, is there anything I can do to solve it, in a way that does not require a server running on my end, to respond to the redirect_uri request? Even if the solution requires the client to go to a secure web page to get the token and return it to the package because that is sort of what is already happening
And again, thanks for the help

[nikkk1]

Is there any way to go around this issue?
Otherwise, I would need an actual infrastructure to host it, right? Since I would need a server running and stuff, and for the package it probably would be the end of it.
Anyways thanks

[Ximzend]

I recommend you to read this fully: https://developer.spotify.com/documentation/web-api/tutorials/getting-started

[nikkk1]

Thanks for the reply
Reading that page, on the bottom, there is what I attached saying that the client_credentials is not fit for multi-user use

My package is only meant to help as many users as possible and all the other 3 auth types require the redirect_url

This is why the package requires the user to log into developer.spotify to get the token, because it was the only way

Now, is there anything I am stating as fact, which is wrong? Please probably the answer I am looking for is there.
Thanks again

[Ximzend]

If you read it and came to the conclusion there's no way around it, there's no way around it.

You can give the users of your module the instructions on how to setup an app with http://localhost:3000/callback as redirect url and let them fill in their client id and client secret.

[nikkk1]

I understand.
What you are saying makes sense.
Thanks for your help.
I am gonna test some things here on my end, to see if I can save my package
Thank you

[nikkk1 · Accepted solution]

Since it is a Python package, I been thinking about using Fast API, since it is effortless and can be both started and killed via a single line of Python code (using uvicorn). Do you think this would be possible? 
I am asking because I couldn't test it yet and think it will be really costly in terms of time and refactorings
Thanks