Token generated using Client Credentials workflow does not work for /me

[alagappann]

Hey,
I used the client credential authorization workflow and successfully generated a access token. I am able to retrieve information regarding user accounts and playlists when using /users in the URL. However, when I use the /me to get my own playlists, currently playing song or recently played songs using /me - it throws different error codes for every request.
Errors returned:
Recently Played - error : {status: 500, message: 'Server error.'}
Currently Playing - error : {status: 404, message: 'Invalid username'}
User Saved Albums - error : {status: 404, message: 'Missing Token'}
I have properly setup the scope as well. Please let me know the issue. I'll attach JS code in comment.
Thanks!

[alagappann]

JavaScript code for the above issue - 

const getAccessToken = () => {

  var authOptions = {

    url: 'https://accounts.spotify.com/api/token',

    headers: {

      'Authorization': 'Basic ' + (new Buffer.from(client_id + ':' + client_secret).toString('base64')),

      'Content-Type': 'application/x-www-form-urlencoded'

    },

    form: {

      grant_type: 'client_credentials',

      scope: 'user-read-playback-state user-read-recently-played user-library-read'

    },

    json: true

  };

  request.post(authOptions, function(error, response, body) {

    if (!error && response.statusCode === 200) {

      var token = body.access_token;

      console.log(token)

      var options = {

        url: 'https://api.spotify.com/v1/me/albums/contains',

        headers: {

          'Authorization': 'Bearer ' + token

        },

        json: true

      };

      request.get(options, function(error, response, body) {

        console.log(body);

      });

    }

  });

};

getAccessToken();

[Ximzend · Accepted solution]

What you used is called Client Credentials Flow: "Since this flow does not include authorization, only endpoints that do not access user information can be accessed."

You should use the Authorization Code with PKCE Flow instead.

[alagappann]

Thank You!

I figured that out. Instead I generated a Authorization code and stored it to generate a refresh token every time using the code.