Suddenly Getting 403 Errors on /me endpoint

[turobiter]

My Question or Issue

I deployed an app on Heroku that works perfectly fine for me (https://bowies-canvas-a86775402ce2.herokuapp.com/). However, I've sent the link to others for testing but they can't make it past typically the same page. They login to Spotify and are redirected to the redirect URI /toptracks which then redirects them to /selectplaylists where they can see a list of their playlists to select to perform some actions. The users cannot get to this /selectplaylists page because of a 403 error. This is the error that is logged:

2024-08-15T15:31:57.140700+00:00 app[web.1]: HTTP Error for GET to https://api.spotify.com/v1/me/ with Params: {} returned 403 due to Check settings on developer.spotify.com/dashboard, the user may not be registered.

I have no clue what the issue is. Is this happening from Spotify's end? The scope I have set is user-top-read, which seems like the correct scope to me. 

[Ximzend · Accepted solution]

Hi turobiter, Welcome to the Community!

As the error message suggests, you should check the settings of your app, as the user might not be registered. You need to add other users with their exact name and email address under User Management. They can copy their email address from the Spotify Account page by clicking Edit Profile.

This is necessary because newly created apps start in development mode, which comes with this limitation and a lower rate limit for testing purposes.

You can read more about it on this page.

I hope this helps! Let me know if you have any other questions.

[turobiter]

Ahh! I see! I seem to have totally missed that you actually quite literally have to add users in the dashboard. My bad. So the only way to make it where I don't have to register and anyone visiting the site can use the app is by submitting an extension request?

[Ximzend]

Yes, that's correct. This article can be hard to find if you don't know where to look. After your testing goes well, you'll need to apply for a quota extension to allow broader access without having to register individual users.