Action on Google was not approved due to violation of Account Linking & Identity policies

Question

• In this AoG i'm using account linking with OAuth and Authorization Code.
• The goal here is to prompt the user if he wants to link his spotify account with the AoG.
• The user will be redirected to a hosted (in S3 bucket) web page after he confirms that he wants to link his account where he will then connect with his spotify account and give the AoG permission to play songs on his speaker.

Upon submission of the AoG it was rejected after the review. The reason is the following :

Your account linking OAuth URL appears to be owned by an external party. Thank you for submitting your Assistant action for review. Unfortunately, your action has been denied for the following:

1. Your Action violates our Account Linking & Identity policies. The OAuth link provided does not appear to be associated with this Action. When implementing account linking using OAuth, you must own your OAuth endpoint or have control over it with an OAuth service provider. You cannot use external parties, such as Spotify or facebook, for your account linking implementation. Please see https://developers.google.com/actions/policies/general-policies#account_linking_and_identity for more information.

does anyone knows how to solve the problem ? Is it even solvable ?

Answer 1

As per the policy, if you want to do account linking you need to be the owner of the OAuth service. If you are not Spotify, you cannot use Spotify directly. You'd need to host your own OAuth which could then add an OAuth connection to Spotify.