[Android SDK] Access token with correct scopes has insufficient permissions

[Onon]

Plan

Premium

Country

Belgium

Device

Galaxy S20FE, but also tested on other devices / emulators

Operating System

Android 11

My Question or Issue

Using the Android auth library provides an access token with insufficient permissions, even though the scopes are set correctly. Using this access code on simple calls such as https://api.spotify.com/v1/me provides a 'Forbidden' response.

I have checked the authorization request, and notice the correct scopes are provided. The user is indeed redirected to a webview containing all these permissions. Upon accepting them, an access token is provided, as expected. The request URL is as follows:

Spotify Auth starting with the request [https://accounts.spotify.com/authorize?client_id=<HIDDEN>
&response_type=token
&redirect_uri=spotify-sdk%3A%2F%2Fauth
&show_dialog=false
&utm_source=spotify-sdk
&utm_medium=android-sdk
&utm_campaign=android-sdk
&scope=streaming%20user-read-email%20user-read-private%20user-read-currently-playing%20user-read-playback-state%20user-modify-playback-state%20user-top-read%20playlist-modify-public%20playlist-modify-private%20playlist-read-private]

However, when using the access token for any API request, the following message is returned:

Forbidden

I am unsure what I am doing wrong here. Using the provided token in other applications (such as Postman) provides the same result. When creating an access token through the online console (https://developer.spotify.com/console/), it does provide the expected results. So I am quite confident the calls are correct.

I should also mention I tested this with a different account a week ago, and it still seems to work using the exact same code (even when removing the app's permissions from the profile, or when trying it on a completely new device!). That account is also the one that registered the application on the online dashboard. It is only when I started testing this with other accounts that it started going wrong. I also tested this on devices which never had Spotify (or my app) installed before, so I do not think it is a caching issue. I am unsure if there are further differences... The account that works uses "Premium for family". The other accounts that don't work are using the "Premium for students" plan and a trial version. 

Expected result

The provided token should provide a correct response for these API calls.

Here is the relevant code for performing the request:

AuthorizationRequest.Builder builder = new AuthorizationRequest.Builder(CLIENT_ID, AuthorizationResponse.Type.TOKEN, getRedirectUri().toString()).setScopes(scopes);
AuthorizationRequest authRequest = builder.build();

loginButton.setOnClickListener((cl) -> AuthorizationClient.openLoginActivity(this, REQUEST_CODE, authRequest));

// ...
protected void onActivityResult(int requestCode, int resultCode, Intent intent) {
        super.onActivityResult(requestCode, resultCode, intent);

        // Check if result comes from the correct activity
        if (requestCode == REQUEST_CODE) {
            AuthorizationResponse response = AuthorizationClient.getResponse(resultCode, intent);

            switch (response.getType()) {
                // Response was successful and contains auth token
                case TOKEN:
                    // Handle successful response
                    Log.d("MainActivity", "Token received");
                    UserData ud = new UserData();
                    ud.setAccessToken(response.getAccessToken());

EDIT: formatting

[spotifyjosh]

Hi @Onon, sorry to hear about the trouble you're having here. What is your app's client ID?

[Onon]

Hi Josh, thanks for your reply.

My client id is cd4e5a2ca570437fb10a9b6a732fd354

I've just tried to make a request with the broken account, in case that helps.

[FokinAN]

Hi, @Josh . I have the same issue, my client id is e7b20bcd68254856b46b62dd04c29501

[Onon · Accepted solution]

I discovered a temporary workaround, whichever fits best for your application:

• Go to your application dashboard, click your application, go to 'Users and access' and add the e-mail address and name of the account you're trying to authenticate. If you have 25 or fewer users and quickly want to test your application, this seems to be the way to go. It can take a few minutes before these changes take effect.
• Authenticate your users by manually having them go to any endpoint on the Spotify console (like /v1/me) and have them request a token with your required scopes manually which you can then use in your application. Admittidely, this is a pretty terrible workaround, so I highly suggest the first option.

I'm not sure why this works. I can only assume Spotify is implementing some type of authorization mechanism for specific users and something started affecting the API. Until this is fixed, I hope this workaround may help with a lot of headaches for future developers!

This workaround works fine for my use case (and hopefully others too!), so for now I'm accepting this reply as a solution.

[FokinAN]

I'm looking for information, I still think this is not a bug, but a planned behavior of dev mode https://developer.spotify.com/community/news/2021/05/27/improving-the-developer-and-user-experience-.... You need add your users if you don't request extension for production.

[Onon]

It's strange because I used their web API to also do authentication in a previous iteration of my application about a month ago, and it didn't seem to present any problems (and still doesn't). It's just with the Android SDK that things started going wrong.

If you're right though, it might be useful for them to mention this somewhere in their API documentation/quickstart guides/response body as I had not found this post yet before.  Thanks for sharing!