Getting HTTP 403 for Web API requests for specific user

[nsmirnov]

Plan

Premium

Device

Web API

My Question or Issue

I am developing an application for Spotify, and a few users are connected. Everything worked fine until a certain moment (and still works fine for all users except one).

However, one user (well, technically, my application using his token) started getting 403 responses to Web API requests (e.g., GET /me, and others). This issue began the day he received an email from Spotify about suspicious activity on his account (an email with a link to reset his password). He changed his password since then, but it didn’t resolve the issue. We are able to log in to Spotify using his account, obtain a token for the app with all the required scopes, but when the app tries to use this token, it gets a 403 error. We removed the app from his account, renewed the token, but nothing worked. He can log in to Spotify and use it normally, but he can't use my app.

It seems like there is some kind of restriction or "flag" on his Spotify account that prevents the use of the Web API with his account.

Tried reaching out to the support team, but had no success.

Writing with a hope to get help 🙂

[nsmirnov · Accepted solution]

Ok, that was because the app is in development mode and I needed to add user to the whitelist.

But it would be nice if the API responded appropriately. I.e. failed to issue the token with a message, or at least added message to this 403 error.