CODEWITHSUNDEEP
authenticationspotify
Res
Res

Reputation: 13

Browserless Authentication using the Web API

I am trying to authenticate a user inside a desktop application using the web api. I am not using a browser, I am using straight up GET and PUSH calls to the endpoints of the Spotify servers. Immediately I ran into some problems. It appears that upon the initial GET command to "accounts.spotify.com", the returned response includes HTML with a javascript function that runs and is responsible for dynamically generating HTML that you see on the initial login page. If you look at the Javascript function, it is clear that this is what is going on, however, you can also see this code is obfuscated and not meant to be used by us, the developers! (Link to Javascript code here for reference: Javascript function)

So my question is, while I can probably reverse engineer the code to get this working, would this be against the Spotify developer TOS?

Thanks!

Upvotes: 1

Views: 398

Answers (1)

Hugh Rawlinson
Hugh Rawlinson

Reputation: 989

Spotify's authentication happens through oauth, and a big part of user authentication as per the oauth rfc is where the user delegates permissions to your app to carry out API calls that affect their account, or return information about them. That's the web page you're seeing - it must be presented to your users so that they can delegate permissions so that Spotify can give your app an access token. It doesn't necessarily need to happen in a browser - it can happen in a web view inside your desktop application - but it does need to be loaded over https, and your application must not alter or reverse engineer the Spotify permissions delegations page.

As you correctly guessed, reverse engineering any Spotify APIs is against terms of service.

For more information on authorization on the Spotify platform, I'd recommend having a look at this guide.

Hope that helps! Please ping me if you have any more questions.

Hugh

Spotify Developer Support

Upvotes: 1

Related Questions