[Web API] Adding tracks to a public playlist requires playlist-modify-private scope

[LostMechanics]

Hello everyone ! 

My use case :

Via the Spotify Web API, I want to create a public playlist and add tracks to it.

My implementation :

I setup a spotify auth flow that requires the playlist-modify-public scope.

Then when I get the auth token I create the public playlist via the corresponding API endpoint (see documentation here) and the API call works perfectly, my new playlist is correctly create, and it's correctly public.

Then i call the endpoint for adding items to a playlist (see documentation here).

But on this call, I get an error (503 - Insufficient Client Scope).

The workaround :

I tried to do the exact same flow but with the playlist-modify-private scope and it's works correctly, the tracks are added to the playlist

Questions : 

I think it's a bug from the Web API, because it's not normal to have the -private scope for updating a public playlist ?

Is it a recent update on the scope management on the spotify side, because it seems to work worrectly 2 or 3 days ago ?

Thank's in advance

[Ximzend]

It is not a bug. Only playlists that are publicly displayed at your/someone's profile are public according to the API. Other, not publicly displayed playlists, are private.

You can read more about it here: https://developer.spotify.com/documentation/web-api/concepts/playlists

[Naianasha]

My app was creating private playlists with the "playlist-modify-private" scope and now today it's breaking with the same Insufficient Scope error as you. I added "playlist-read-private" to the scopes and now it's working. So suddenly playlist-read-private is required to add tracks to a playlist that was just created by the app.

RIP my extension requests that have been waiting to be acknowledged for weeks and now have the incorrect auth scopes in them.

[Borkware]

I have an app with both "playlist-modify-private" and "playlist-read-private", and getting 403 / 

Insufficient client scope when trying to create the playlist.

[jwmp]

Another "Me Too" post.

My Python script using Spotipy that has been working for years can no longer add tracks to a new playlist.

I've tried various options without success:

with user_playlist_create(public=True, ...)
scope="playlist-modify-public"

with user_playlist_create(public=False, ...)
scope="playlist-modify-private"
scope="playlist-modify-private,playlist-read-private"
scope=["playlist-modify-private", "playlist-read-private"]

[Naianasha]

Is your app in development mode or production? If production do you have those scopes available to you? I think that adding "playlist-read-private" worked for me because my app is still in development, it has access to all the scopes although it's not publicly accessible.

If I have to submit a whole new extension request to get this scope in production I will cry. 

[thejynx]

My app that has been running for years has been struck by this around 10 hours ago according to logs, attempts to add tracks to new playlists are returning 403. It might be a distraction but it looks like despite setting public to false when creating new playlists they are being created a public anyway, and something has happened today to enforce the public scope requirement (I currently only have private).

My app has the quota extension granted.

I managed to fix this locally for myself by adding scopes as suggested by other users and removing the app and re-adding it - of course this isn't a suitable fix for my user base!

[jwmp]

My apps are in Development. No quota restrictions. One user configured.

[thejynx]

Scopes need to be space separated for WebAPI. Also you might need to remove the app from your account for the changes to take effect.

[Borkware]

Production, for 8? Years and three different SDKs. Current one using the latest iOS sdk for the last year and a half (when the Streaming SDK got terminated). Worked great until very recently. 

[LostMechanics]

@Ximzend The playlist I create is public, I use the API endpoint with the public property to true (see documentation here), the response says that it's public and on my spotify profile, it's public too

[Lkole]

Same problem here ! My app was working perfeclty fine, creating public playlist and now I have this error : 

ERROR:spotipy.client:HTTP Error for POST to https://api.spotify.com/v1/playlists/playlist_id_here/tracks with Params: {'position': None} returned 403 due to Insufficient client scope.

I've tried adding the "position" parameter to my code but it hasn't been recognized by spotipy yet.

[pauliephonic]

I have the same issue as well, using ruby client.

My use case is creating a public playlist and adding tracks to it for users.

As I wanted to use best-practices and limit permissions to only those needed I only ask permission for playlist-modify-public (i.e. users havent granted playlist-modify-private or playlist-read-private as I'm only modifying the public playlist I created)

Since yesterday, all attempts to add tracks to the playlist fail with a 429 error. No changes to code. All other API calls work for users.

If I modify the grant request to include playlist-modify-private and playlist-read-private then adding to the public playlist works as expected.

Was there any announcement of changes to the API or permissions that I missed?

I can obviously increase the permissions requested but this will require all users to re-link spotify. I'd rather avoid this if there's a chance that this is an API regression and will be fixed.

Do any of you guys know if there any way to find out if this will be fixed or to contact support?

[Ximzend]

Everyone should read this: https://developer.spotify.com/documentation/web-api/concepts/playlists

In short: only playlist that are publicly display at your/someone's profile are public. Other playlists are private.

[LostMechanics]

Thanks for your reply, but it's not related to our problem. 

We are talking about adding tracks to a public playlist, so we know what is a public playlist and as it's said in the page you linked, we must use only the playlist-modify-public scope to be able to update it.

[Lkole]

I didn't change my code but it seems working again ... I have no explanation - seems like Spotify fixed it. 

[Borkware]

In my case, it's private paylists, and I have both the read and modify private playlist scope

[thejynx]

Same here, a quick local test suggests this is working again.

[Borkware]

Bummer, it's still broken for all my users 😞

[Naianasha]

Does Spotify ever communicate any of these changes/fixes/anything? This is the most frustrating API integration I've ever worked with.