Insufficient Client Scope after Refresh Token

[Falcuun]

Hi All, 

I am trying to build an embedded application that will simply add the current song playing to a specified playlist [playlist_id]. The issue that I'm running in is that when I follow the guide on generating Authentication tokens, I'm getting "Insufficient Client Scope" error. 

I use: 
https://accounts.spotify.com/authorize?client_id=<my_client_id>&scopes=playlist-read-private%20playl...

URL to generate an access token that will work for the given scopes. 

Once I get to the Auth page and authorize the app, I obtain the Auth token for the next step.

After getting the token, I run:
curl -H "Authorization: Basic <base64(client_id:client_secret)>" -d grant_type=authorization_code -d code=<auth_token> -d redirect_uri=http%3A%2F%2Flocalhost%3A8080 https://accounts.spotify.com/api/token

Command in order to get the JSON containing `access_token`, `token_type`, `expires_in` and `refresh_token`.

Issue comes when I try to use the endpoints for adding songs to the playlist and I try to pass it either the `access_token` generated in this response. 

Or the `access_token` generated by running:

grant_type=refresh_token&refresh_token=<refresh_token>

I keep getting the same error. 

All the while, if I use the token builder on Spotify's website, it will work as it should, for an hour, until it expires. 

Any idea why my tokens aren't generated correctly? For a reference, tokens that I get in the JSON response are about 173 characters long whereas the one that is generated in Spotify's website is about 240+ characters long.

Thank you in advance for the help!

[Prague · Accepted solution]

Tail-wagging hello to you Falcuun!

The "Insufficient Client Scope" error you are receiving suggests that the access token you are using does not have the necessary permissions to perform the action you are trying to take. In this case, it seems like your access token is missing the necessary scope for adding a song to a playlist.

To add the necessary scope to your access token, you will need to modify the authorization URL to include the playlist-modify-public or playlist-modify-private scope, depending on whether the playlist is public or private.

For example, you could modify the authorization URL to include the playlist-modify-public scope as follows:

https://accounts.spotify.com/authorize?client_id=<client_id>&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8080&scope=playlist-modify-public

Alternatively, if you are using the Spotify Web API library for your language, you can add the necessary scope when creating the authorization URL: 

sp_oauth = oauth2.SpotifyOAuth(
    client_id=<client_id>,
    client_secret=<client_secret>,
    redirect_uri=<redirect_uri>,
    scope='playlist-modify-public'
)
auth_url = sp_oauth.get_authorize_url()

Once you have authorized the app with the necessary scope and obtained an access token, you should be able to use it to add a song to a playlist.

If you continue to experience issues with generating valid access tokens, you may want to double-check that your client ID and client secret are correct and that you are using the correct authorization flow for your use case. Additionally, it may be helpful to review the Spotify API documentation and see if there are any specific requirements or limitations that apply to your use case.

My ears are perked up and waiting for updates!

-Prague the Dog

[Falcuun]

Good Boy, Prague! 

That worked. I think what the main issue was, was the order of parameters in the URL. Moving `scopes` to the end of the URL actually requests the scopes to be added. Seems my issue was way simple than what I was making it out to be. 

Thank you so much for the help! 🍖

[martinweiss]

Hi, I am trying to do something similar but using the scope for user-read-recently-played. Is there any way I can add this scope manually through the dashboard or do I need to follow the same process? I did what was above and got a code from the URL. Where would I use that? Also, I want to make an application that can generate refresh tokens on its own so this can be a one-time process. Any help would be greatly appreciated.