Increasing security requirements for integration with Spotify Web API

[ThePodfather]

Hey all, we’re making some changes to the Spotify Web API. To improve security, we are planning to remove support for two ways of integrating with Spotify that have been replaced with more secure alternatives.

Please check the Spotify for Developers blog for further information

[anty_ant_ant]

Is the intent of this to block folks from using Car thing hardware for the DeskThing project?

[S4vageDreams]

I got this notification and the only 2 things I'm aware of currently that are active are Spoticord(Discord Bot) and Lumia Stream integration for Spotify. I will get rid of both of them if I have to im just wanting to know which it is

[brtmax]

@ThePodfather

This change is not currently working as intended I believe. When I change the loopback URI to something using 127.0.0.1 instead of localhost, it get's automatically translated to "localhost" in the developer dashboard after refreshing the page.

For example:

If I edit the settings in the developer dashboard, enter http://127.0.0.1:8888/callback, save and refresh the page, it says http://localhost:8888/callback

Edit:

[Ximzend]

Hi @brtmax that's weird. I'm going to look if it also happens to me.

Update: it happens to me as well, but if I go to another page and go back, the changes are there.

[Morganic1]

Thanks for the heads up.

Just wondering, the wording regarding PKCE and Authorization Code is a bit ambigiously formulated. I hope you guys will be able to clear up any doubt regarding that:

You write the following in the 'What's next' section: "If you are using a public client (one which cannot securely store a secret), you will be expected to use the PKCE extension. Confidential clients (ones which can store a secret) must use it.".

I'm a bit puzzled if the 'must use it' in regards to confidential clients refers back to the PKCE extension or the Authorization Code Flow as a whole. I would expect there to be no changes in terms of the existing Authorization Code flow, and that this is not being deprecated for the Authorization Code PKCE flow. 

Could you please confirm that this is indeed correctly understood? And if so, please consider updating the blog posts, as it is a bit ambigious.

Thanks again.

[malikmohsin]

"As Spotify increases security requirements for Web API integration, will this impact third-party apps like FlixFox? It’s crucial for developers to stay updated and ensure compliance. Can we get clarity on the specific changes affecting existing integrations?"

[MarvinBrouwer]

I asked this question to support first, they referred me to reply to this thread.

I am making an app to scan Spotify codes and playing them without seeing the song (I will probably add a feature to show the attribution afterward to comply with those terms)
It's not a game in itself, but, we intend to use this for trivia quizzes with friends.
Today I read the developer terms, and I came across this line: "2. Do not create a game, including trivia quizzes."
You can check it here for reference: https://developer.spotify.com/policy 
I'm mostly wondering about this policy term.
I see in the community I'm not the only one.
In fact, I've played a game doing this exact thing called Hitster.
This community post also references that: https://community.spotify.com/t5/Spotify-for-Developers/The-quiz-game-maybe-it-s-time-to-answer/m-p/...
What is your current stance on this policy?

This article has been created in 2023 and hasn't had an official reply from Spotify yet.
I found some other community posts about this too, no reply from Spotify.

Please let me know what the current stance is on this policy, and what we can do about removing it.
Edit:
Similar to @Richardschreurs's reply, if there is a way to get exemption from policy by means of contract or partnership, please be transparent about this and tell us.
And perhaps if true, explain how to apply.

[Richardschreurs]

So no reply from Spotify. I really want to be a partner of Spotify, like Hitster is. How can I arrange such a thing? Anybody managed to do this?

[SemajOG]

This stuff pisses me off when I like a artist but they have 3 albums AND 8 FING THOUSAND SINGLES PLEASE MAKE A OPTION ON THERE ARTIST PAGE TO ADD ALL SONGS THEY MADE/FT IN I DON'T LIKE SPENDING 30MINS JUST TO ADD ALL THERE WORK WITH A SIDE OF CARPETUNNEL SYNDROME IF THERE A SONG I DON'T LIKE ILL JUST UN ADD IT 

[Irishtalkers]

I am not sure whether this is a result of the API changes or not, but the 400+ episodes embedded on our website www.irishtalkers.com using the previous iFrame code no longer work. Instead, the embed code has been completely changed and I see no way of accessing that code until the podcast has been published. Is there any way of getting this code from inside the editing pages for the podcast?

[GrimmReaper1O1]

Hello, great to talk to all of you. I know it's a rude question to ask but is your webplaybackSDK working at the moment. I've got the tokens to access tracks but I can't for the life of me get the dam thing to play a track with a wrapper or any method I try and I'm about to give up. All I get is the PUT 400 bad request at the moment. Would appreciate any advice I can get at this point.

[HDD-1960]

7th April 2025

Migrating from Implicit Grant Flow to Authorization Code with PKCE, has been a nightmare!
No help or actual working examples anywhere.
AND no comments on here to ask how to get it to work, despite the "internet" full of complaint about the mess and no fixes available

Maybe it't just me who's struggling, but then I am nearly 76, and have been using a home made App almost every day for 4 years.

Any tips, help, fixes, suggestions (polite ones please)
I would be grateful for any help as to what I'm doing wrong please..

###################################################
So, here is what I've tried so far, with no joy..

If I run the following code, using Spotipy and Python:
On the Browser, returns "Illegal scope"
(Yes I have tried MANY combinations, all of those that had worked before!!

I The Python crashed with the error:
DeprecationWarning: You're using 'as_dict = True'.get_access_token will return the token string directly in future versions. Please adjust your code accordingly

On the Spotify Developer Dashboard:
Go to the https://developer.spotify.com/dashboard/applications.
Edit my existing application or edit.
Change my redirect_uri="http://127.0.0.1:1234"

In my Application:
import spotipy
from spotipy.oauth2 import SpotifyOAuth
import requests
import uuid

My application credentials:
client_id = "<--- my client_id ---->"
client_secret = "<--- my client_secret ---->"
redirect_uri = "http://127.0.0.1:1234"

scope = "user-read-playback-state,user-modify-playback-state"

auth_code = ""

Generate a PKCE Code Challenge, a random code verifier:
code_verifier = uuid.uuid4().hex
print("Code Verifier:", code_verifier)

code_challenge = requests.utils.quote(uuid.uuid4().hex, safe='')
print("Code Challenge:", code_challenge)

Authorization URL
auth_url = f"https://accounts.spotify.com/authorize?client_id={client_id}&response_type=code&redirect_uri={redire..."
print("Authorization URL:", auth_url)

Redirect me to my *redirect_uri* with an authorization code:

Exchange the authorization code for an access token
sp_oauth = SpotifyOAuth(client_id, client_secret, redirect_uri, scope, code_verifier)
token_info = sp_oauth.get_access_token(auth_code)

print("Access Token:", token_info['access_token'])

Create a Spotify object with the access token:
sp = spotipy.Spotify(auth=token_info['access_token'])

Make API requests
results = sp.current_user_playing_track()
print(results)

<END>

[Ximzend]

Hi @HDD-1960 

Have you tried deleting the .cache file from the running directory before running your program again?

[HDD-1960]

Hi and thanks for the ver prompt reply..

Not deliberately deleted cache, but tried on a different PC and get the same results.

But will defo try again.. 

Best regards 

[hufman]

How do I test out the changes needed for the app? The email says new developer keys "from the beginning of April" will have the increased security requirements, but how do I confirm the changes for sure?

[Paulthelol]

Is there any way the use of a signed localhost, such as https://localhost:3000/ is permitted? Given its use of https, I am able to enter it as a Redirect URI in the dashboard (although it sometimes disappears after hitting save), however I still receive the error: INVALID_CLIENT: Insecure redirect URI. I ask this because my current authentication pipeline is unable to use any other redirect URI (most likely due to an underlying bug in auth.js).

[BojackH]

@ThePodfather

It appears that there is a significant bug since April 9. The Spotify for Developers blog indicates that redirects such as com.example://callback can still be used as previously, but this is not the case. The Demo apps for the iOS SDK are failing, and authentication does not work for Spotify apps created after April 9.

Could you please provide an update on this matter? If Spotify anticipates that developers using the mobile SDKs will modify the authorization flow, is it possible for Spotify to update the Demo apps so that we have a reference?

Thank you for your attention to this issue.

[faiqharris]

Thanks for the heads-up! Strengthening security is always a good move, and we appreciate the proactive update. We'll review the Spotify for Developers blog to ensure our integrations stay up-to-date. Looking forward to implementing the new secure methods!

[alinarizwan]

thanks for sharing the info