INVALID_CLIENT: Insecure redirect URI, using custom URI

[Cbooch13]

Plan

Premium

Country

US

Device

Samsung S20 FE

Operating System

Android

My Question or Issue


Hello everyone,

I am new to the spotify API and I am trying to complete the Oauth authorization flow for my android application.  After my app redirects me to the spotify login page, I login, and it redirects me to a page that says "INVALID_CLIENT: Insecure redirect URI", it does NOT say "INVALID_CLIENT: Invalid redirect URI" which makes me believe it is a security issue.  I am using a custom redirect URI, let's call it "com.myapp://callback".  I have added this exactly to the redirect URI of my spotify dashboard for this project, and have verified that I wrote this exactly everywhere else in my project that required a redirect URI.

If anyone has any insight on this then I'd really appreciate it.  I feel that it has something to do with spotify's new redirect URI security requirements, but I thought that those didn't apply to custom URIs for mobile apps and I'd appreciate any insight.

EDIT:
I have tested my application with a client id from a spotify project that I had created before April 9th (the date of the Spotify rules being enforced), and the application worked perfectly.  This leads me to believe that it is an issue with the new redirect URI rules and how custom URIs are handled for mobile applications.

[pebbe]

Now it's unfixed again

[lesterw]

FYI: The Authorize API has undergone another change as of 27-Nov-25. Spotify has deprecated the Implicit Grant Flow authorization. Applications must now use the Authorization Code with PKCE flow. Using the old flow now generates an INVALID_CLIENT: Invalid redirect URI error.
See: https://developer.spotify.com/documentation/web-api/tutorials/migration-implicit-auth-code

[mrjosh86]

I assume this is why my your_spotify docker container is now dead?

[jvmauricio]

yeps. your_spotify dead on my server

[upgrader-dev]

I had the same issue then deleted 'localhost' from the dashboard. Now I get a Spotify error page saying 'something went wrong'. I use to use https://127.0.0.1 on local dev, maybe that is the issue?

[pebbe]

You can't use https on localhost

[Ximzend]

Hi @upgrader-dev 

I think you should use http://127.0.0.1:1234 (or with another port number) instead instead of https://127.0.0.1

[upgrader-dev]

Thanks @Ximzend and @pebbe, I guess I have to move all my local setup from https to http.