[iOS] Spotify iOS SDK give invalid client secret error when authorise via Spotify app

[teehyen]

Plan

Free/Premium

Country

Device

(iPhone 11 Pro Max)

Operating System

(iOS 14.7.1.)

My Question or Issue

Our app is using iOS Spotify SDK to manage user playlists. The app use 

SPTSessionManager to authenticate the user 

It is working fine in 8.6.56 but it is not working with recent Spotify app releases (8.6.68, 8.6.70)

This is the flow we are using: 

- The app initiateSession:

sessionManager.initiateSession(

            with: [.playlistModifyPublic, .playlistModifyPrivate, .playlistReadPrivate],

            options: [.default]

        )

- The Spotify app will be opened

-  The Spotify called a oAuth endpoint

https://accounts.spotify.com/oauth2/v2/auth?client_id=XXXX&response_type=code&redirect_uri=XXXX&clie...

- Then Spotify app give my app the deeplink like  this 

app://spotify/?code=XXXX

- Then inside our app we called 

sessionManager.application(app, open: url, options: options)

- This called returned {"error":"invalid_request","error_description":"Invalid client secret"}

It is working when I run local server and added tokenSwapURL and tokenRefreshURL. However this is not an option for us to have a additional server. 

It is also working when I force the web view authorisation by removing "spotify" out of LSApplicationQueriesSchemes. But this is not a desired UX flow. 

Is there some change recently that I should be aware of? How do we fix this?

Thanks for your time.

[Usama2810]

I'm also having this issue for past few days on iOS. As you have mentioned the scenarios where it works. I also found one, it also works when we login the Spotify app with Sri Lankan account. I have tried changing the country using VPN but it does not works. Only works when we use Sri Lankan account, thats weird but its happening.

[teehyen]

Thanks for your reply.

I aslo found another workaround, instead of using

sessionManager.application(app, open: url, options: options)

I made a call to /token with the code provided by spotify app, then pass in client_secret in the request.

This worked but storing client secret in the code is not recommended.

[Usama2810]

Thats great ! But I am stuck with this issue for days now. 

As you said, It is working when you run local server and added tokenSwapURL and tokenRefreshURL. However this is not an option for us to have a additional server. 

Can you you please guide me, how are you running the local server for tokenSawap and refresh, because It does not hit the tokenSwap url in my app.

here is my Spotify config: 

private async authenticate({

playURI,

showDialog = false,

authType,

}: AuthOptions = {}) {

const config: ApiConfig = {

clientID: id,

redirectURL: redirect,

// tokenRefreshURL: 'https://spinsapi.pixarsclients.com/public/api/v1/spotify/swap',

// tokenSwapURL: 'https://spinsapi.pixarsclients.com/public/api/v1/spotify/swap',

scopes: [ApiScope.AppRemoteControlScope],

playURI,

showDialog,

authType,

};

try {

// Go and check if things are connected

const isConnected = await remote.isConnectedAsync();

this.setState(state => ({

...state,

isConnected,

}));

// Initialize the session

const {accessToken: token} = await auth.authorize(config);

this.setState(state => ({

...state,

token,

}));

await remote.connect(token);

} catch (err) {

this.onError(err);

}

}

[teehyen]

Not sure how it works on node but for me it worked when I implemented this flow https://developer.spotify.com/documentation/general/guides/authorization/implicit-grant/
Hope it helps.