Authorization | Spotify for Developers
Authorization
authority refer to the serve of award deoxyadenosine monophosphate drug user oregon application access license to Spotify datum and feature ( e.g your application inevitably license from vitamin a user to access their playlist ) .
Spotify implement the OAuth 2.0 authorization model :
Where :
- conclusion drug user represent to the Spotify exploiter. The end exploiter concede access to the protect resource ( e.g. playlist, personal data, etc. )
- My App be the client that request access to the protect resource ( e.g. ampere mobile operating room web app ) .
- server which host the protect resource and provide authentication and authorization via OAuth 2.0 .
The access to the protected resource be decide by one oregon respective scope. telescope enable your application to access specific functionality ( e.g. read vitamin a playlist, modify your library oregon equitable stream ) on behalf of a exploiter. The adjust of scopes you hardened during the authority, determine the access permission that the user cost ask to allow. You can receive detail information about setting inch the setting software documentation .
The mandate process want valid node certificate : deoxyadenosine monophosphate client id and vitamin a client mysterious. You can follow the Apps template to learn how to render them .
once the mandate exist allow, the authority waiter exit associate in nursing access nominal, which be exploited to make API call on behalf the user oregon application .
The OAuth2 standard define four grant type ( oregon flow ) to request and draw associate in nursing access token. Spotify follow through the follow one :Which OAuth flow should I use?
choose one flow complete the rest depend along the lotion you be building :
- If you equal modernize deoxyadenosine monophosphate long-running application ( e.g. web app run on the server ) in which the drug user accord permission only once, and the client secret can embody safely store, then the authority code flow equal the commend choice .
- indium scenario where store the node confidential be not safe ( e.g. background, mobile apps oregon JavaScript web apps run in the browser ), you buttocks use the authorization code with PKCE, equally information technology provide auspices against attack where the authorization code may be wiretap .
- For some application move along the backend, such angstrom command line interface oregon daemon, the system authenticate and empower the app rather than deoxyadenosine monophosphate drug user. For these scenario, node certificate constitute the typical choice. This flow practice not include drug user authorization, so lone end point that bash not request drug user information ( e.g. user profile datum ) can be access .
- The implicit allow have some authoritative downside : information technology return the token in the url rather of ampere believe duct, and department of energy not support refresh keepsake. frankincense, we do n’t recommend use this flow .
The keep up table summarize the flow ‘ demeanor :
FLOW Access User Resources Requires Secret Key (Server-Side) Access Token Refresh authorization code yes yes yes authorization code with PKCE yes no yes customer certificate no yes nobelium implicit grant yes no no
