[GH-ISSUE #155] Spotify authentication issues? #86

Closed
opened 2026-02-27 19:28:20 +03:00 by kerem · 16 comments
Owner

Originally created by @tobsch on GitHub (Feb 8, 2026).
Original GitHub issue: https://github.com/lox-audioserver/lox-audioserver/issues/155

Hi there,

I just updated to beta5 - great job so far!
It is stunning how professional the setup got.

I am not sure what i did wrong but I wanted to connect "native spotify" with my account and the client id 26faeb2006ba44ed89ac34f9344670e2.
It connects and authenticates, but the docker console is full of errors:
lox-audioserver | [2026-02-08T20:30:52.558Z][WARN][Audio|@lox-audioserver/node-librespot] [hasAccessToken=false hasClientId=true] native connect skipped; missing access token

This seems to be only if I enable spotify connect.
If I disable it, I still see many of those errors:

lox-audioserver | [2026-02-08T20:44:40.485Z][WARN][Audio|@lox-audioserver/node-librespot] [deviceName=lox-zone-8 message="spirc start failed: Invalid state { Login request was denied: BAD_REQUEST }" publishName=Backupküche] native connect host failed

Any idea?

Thanks

Originally created by @tobsch on GitHub (Feb 8, 2026). Original GitHub issue: https://github.com/lox-audioserver/lox-audioserver/issues/155 Hi there, I just updated to beta5 - great job so far! It is stunning how professional the setup got. I am not sure what i did wrong but I wanted to connect "native spotify" with my account and the client id 26faeb2006ba44ed89ac34f9344670e2. It connects and authenticates, but the docker console is full of errors: ` lox-audioserver | [2026-02-08T20:30:52.558Z][WARN][Audio|@lox-audioserver/node-librespot] [hasAccessToken=false hasClientId=true] native connect skipped; missing access token` This seems to be only if I enable spotify connect. If I disable it, I still see many of those errors: `lox-audioserver | [2026-02-08T20:44:40.485Z][WARN][Audio|@lox-audioserver/node-librespot] [deviceName=lox-zone-8 message="spirc start failed: Invalid state { Login request was denied: BAD_REQUEST }" publishName=Backupküche] native connect host failed` Any idea? Thanks
kerem closed this issue 2026-02-27 19:28:20 +03:00
Author
Owner

@anlx-sw commented on GitHub (Feb 9, 2026):

hi, i have also issues with spotify and beta 5 - see issue #145 . have you tried adding the client id and account link again? have you modified the callback link pointing to the new repo url?

<!-- gh-comment-id:3871388702 --> @anlx-sw commented on GitHub (Feb 9, 2026): hi, i have also issues with spotify and beta 5 - see issue #145 . have you tried adding the client id and account link again? have you modified the callback link pointing to the new repo url?
Author
Owner

@tobsch commented on GitHub (Feb 9, 2026):

@anlx-sw It's beta 5 for me too. The callback link is correct. I tried re-adding spotify, yes, it does not work.

<!-- gh-comment-id:3873492858 --> @tobsch commented on GitHub (Feb 9, 2026): @anlx-sw It's beta 5 for me too. The callback link is correct. I tried re-adding spotify, yes, it does not work.
Author
Owner

@tobsch commented on GitHub (Feb 9, 2026):

Update: I re-added my Spotify account and verified that all credentials are now properly stored in config.json — the account entry has a refreshToken, librespotCredentials (with auth_type: 1 + auth_data), and shows
product: "premium". So the OAuth flow itself completes successfully.

However, the spirc start failed: Invalid state { Login request was denied: BAD_REQUEST } error persists on all 11 zones. The logs also show node-librespot cycling through access points ("Try another access point...")
before each zone fails.

I had Claude help me debug this, and Claude's suggestions are:

  • The issue is not missing or misconfigured credentials — Spotify is actively rejecting the stored credentials at the protocol level
  • The bundled node-librespot likely uses a deprecated authentication method. Spotify deprecated username/password auth in mid-2024, and the upstream librespot project addressed this with OAuth2-based authentication
    (https://github.com/librespot-org/librespot/pull/1309). The node-librespot version in lox-audioserver may not have picked up this fix yet
  • Spotify also recently (Feb 6, 2026) reduced Development Mode apps to 5 users and tightened API restrictions further, which could compound the issue

So from my side, the config looks correct - this seems to need a fix in node-librespot to use a supported auth flow.

<!-- gh-comment-id:3873553348 --> @tobsch commented on GitHub (Feb 9, 2026): Update: I re-added my Spotify account and verified that all credentials are now properly stored in config.json — the account entry has a refreshToken, librespotCredentials (with auth_type: 1 + auth_data), and shows product: "premium". So the OAuth flow itself completes successfully. However, the spirc start failed: Invalid state { Login request was denied: BAD_REQUEST } error persists on all 11 zones. The logs also show node-librespot cycling through access points ("Try another access point...") before each zone fails. I had Claude help me debug this, and Claude's suggestions are: - The issue is not missing or misconfigured credentials — Spotify is actively rejecting the stored credentials at the protocol level - The bundled node-librespot likely uses a deprecated authentication method. Spotify deprecated username/password auth in mid-2024, and the upstream librespot project addressed this with OAuth2-based authentication (https://github.com/librespot-org/librespot/pull/1309). The node-librespot version in lox-audioserver may not have picked up this fix yet - Spotify also recently (Feb 6, 2026) reduced Development Mode apps to 5 users and tightened API restrictions further, which could compound the issue So from my side, the config looks correct - this seems to need a fix in node-librespot to use a supported auth flow.
Author
Owner

@rudyberends commented on GitHub (Feb 10, 2026):

Those assumptions are not correct. node-librespot is a custom implementation that uses custom authentication flows, backed by the latest Rust librespot libraries. It is not relying on deprecated username/password authentication.

I did a major refactor of lox-audioserver some time ago, and it’s quite possible that this refactor unintentionally broke part of the authentication flow for spotify.

In addition, Spotify has recently made changes to their API that appear to only affect new users, and these changes have effectively broken librespot itself (for new users). Since lox-audioserver uses the same underlying libraries as librespot, we are running into the same issues. Unfortunately, this also means I can’t reproduce the problem myself anymore, as I have a new spotify account myself, which makes troubleshooting more difficult.

That said, based on the logs you shared here, I should be able to identify and fix the issue.

If you’d like to try something on your side in the meantime, you could experiment with downgrading node-librespot to an older version. For example, you might try reverting to v0.3.0 or possibly even v0.2.0 and see if that changes the behavior.

<!-- gh-comment-id:3876187612 --> @rudyberends commented on GitHub (Feb 10, 2026): Those assumptions are not correct. node-librespot is a custom implementation that uses custom authentication flows, backed by the latest Rust librespot libraries. It is not relying on deprecated username/password authentication. I did a major refactor of lox-audioserver some time ago, and it’s quite possible that this refactor unintentionally broke part of the authentication flow for spotify. In addition, Spotify has recently made changes to their API that appear to only affect new users, and these changes have effectively broken librespot itself (for new users). Since lox-audioserver uses the same underlying libraries as librespot, we are running into the same issues. Unfortunately, this also means I can’t reproduce the problem myself anymore, as I have a new spotify account myself, which makes troubleshooting more difficult. That said, based on the logs you shared here, I should be able to identify and fix the issue. If you’d like to try something on your side in the meantime, you could experiment with downgrading node-librespot to an older version. For example, you might try reverting to v0.3.0 or possibly even v0.2.0 and see if that changes the behavior.
Author
Owner

@tobsch commented on GitHub (Feb 10, 2026):

trying 0.3.0 right now ("The lox-audioserver beta code uses startConnectDeviceWithToken() which was introduced in v0.3.0. Downgrading to v0.2.0 would require modifying the
lox-audioserver source code. v0.3.0 is API-compatible and predates v0.3.1's "token-to-credentials connect host path" change which may have caused
the auth issue").

Unfortunately, I stell see this error:

[2026-02-10T18:49:48.915Z][WARN][Audio|@lox-audioserver/node-librespot] [deviceName=lox-zone-5 message="spirc start failed: Invalid state { Login request was denied: BAD_REQUEST }" publishName=Wohnzimmer] native connect host failed
[2026-02-10T18:49:51.197Z][WARN][Audio|@lox-audioserver/node-librespot] [deviceName=lox-zone-10 message="spirc start failed: Invalid state { Login request was denied: BAD_REQUEST }" publishName=Außenbereich] native connect host failed
<!-- gh-comment-id:3880064955 --> @tobsch commented on GitHub (Feb 10, 2026): trying 0.3.0 right now ("The lox-audioserver beta code uses startConnectDeviceWithToken() which was introduced in v0.3.0. Downgrading to v0.2.0 would require modifying the lox-audioserver source code. v0.3.0 is API-compatible and predates v0.3.1's "token-to-credentials connect host path" change which may have caused the auth issue"). Unfortunately, I stell see this error: ``` [2026-02-10T18:49:48.915Z][WARN][Audio|@lox-audioserver/node-librespot] [deviceName=lox-zone-5 message="spirc start failed: Invalid state { Login request was denied: BAD_REQUEST }" publishName=Wohnzimmer] native connect host failed [2026-02-10T18:49:51.197Z][WARN][Audio|@lox-audioserver/node-librespot] [deviceName=lox-zone-10 message="spirc start failed: Invalid state { Login request was denied: BAD_REQUEST }" publishName=Außenbereich] native connect host failed ```
Author
Owner

@wiking-at commented on GitHub (Feb 12, 2026):

I add some debug infos to this issue - and use this issue for the authentication problems introduced with the latest beta (or spotify) in the last days.

Image Image

After authentication with my premium account the spotify redirect page displays the error:
INVALID_CLIENT: Invalid redirect URI

In my address bar i see the following URL (sensitive data masked with xxx):
https://accounts.spotify.com/authorize?client_id=83xxx9&response_type=code&redirect_uri=https%3A%2F%2Flox-audioserver.github.io%2Flox-audioserver%2Fspotify-callback%2F&scope=playlist-read-private+playlist-read-collaborative+playlist-modify-private+playlist-modify-public+user-library-read+user-library-modify+user-follow-read+user-follow-modify+user-read-email+user-read-private+user-read-currently-playing+app-remote-control+user-modify-playback-state+user-read-playback-state+streaming&code_challenge_method=S256&code_challenge=_4IxxxR3Y&state=http%253A%252F%252F10.x.y.z%253A7090%252Fadmin%252Fapi%252Fspotify%252Fauth%252Fcallback%253Fstate%253Dcontent%253Aspotify%253A5xxx0

so i suppose there is a new format for the callback which spotify doesn't like, the redirect uri has to be unique for all dev apps (unlikely) or something else is going on (e.g through changes in the codebase).

@rudyberends
is there anything else I can provide to facilitate debugging? I don't build from git - I use the beta containers you provide.

<!-- gh-comment-id:3889200364 --> @wiking-at commented on GitHub (Feb 12, 2026): I add some debug infos to this issue - and use this issue for the authentication problems introduced with the latest beta (or spotify) in the last days. <img width="1104" height="812" alt="Image" src="https://github.com/user-attachments/assets/e7f9ccc4-ba9e-4802-af16-6fc9ed366589" /> <img width="747" height="301" alt="Image" src="https://github.com/user-attachments/assets/3b22874a-38d7-4dc2-a071-a7bea3ee0b08" /> After authentication with my premium account the spotify redirect page displays the error: `INVALID_CLIENT: Invalid redirect URI` In my address bar i see the following URL (sensitive data masked with xxx): https://accounts.spotify.com/authorize?client_id=83xxx9&response_type=code&redirect_uri=https%3A%2F%2Flox-audioserver.github.io%2Flox-audioserver%2Fspotify-callback%2F&scope=playlist-read-private+playlist-read-collaborative+playlist-modify-private+playlist-modify-public+user-library-read+user-library-modify+user-follow-read+user-follow-modify+user-read-email+user-read-private+user-read-currently-playing+app-remote-control+user-modify-playback-state+user-read-playback-state+streaming&code_challenge_method=S256&code_challenge=_4IxxxR3Y&state=http%253A%252F%252F10.x.y.z%253A7090%252Fadmin%252Fapi%252Fspotify%252Fauth%252Fcallback%253Fstate%253Dcontent%253Aspotify%253A5xxx0 so i suppose there is a new format for the callback which spotify doesn't like, the redirect uri has to be unique for all dev apps (unlikely) or something else is going on (e.g through changes in the codebase). @rudyberends is there anything else I can provide to facilitate debugging? I don't build from git - I use the beta containers you provide.
Author
Owner

@rudyberends commented on GitHub (Feb 12, 2026):

@wiking-at thanks for the info — I can reproduce your issue. With older apps/client IDs it still works, but when creating a new Spotify app now I see the exact same failure you’re hitting.

This should be an easy fix on its own, but there are a few bigger Spotify problems at the moment. Right now the Spotify provider uses the Rust librespot libraries to route playback through a librespot instance, and that’s not ideal. On top of that, Spotify recently changed something that seems to affect “newer” accounts: librespot has become unreliable there. I’m affected by this myself, which also makes it harder to troubleshoot and validate fixes properly.

I did a custom Spotify implementation myself that does not use librespot (more comparable to the Apple Music/Deezer providers). I’m considering switching to that implementation instead. I need some time to verify a few things first.

If I decide to keep the current librespot-based path, I’ll fix the specific issue you’re seeing there.

<!-- gh-comment-id:3892191638 --> @rudyberends commented on GitHub (Feb 12, 2026): @wiking-at thanks for the info — I can reproduce your issue. With older apps/client IDs it still works, but when creating a new Spotify app now I see the exact same failure you’re hitting. This should be an easy fix on its own, but there are a few bigger Spotify problems at the moment. Right now the Spotify provider uses the Rust librespot libraries to route playback through a librespot instance, and that’s not ideal. On top of that, Spotify recently changed something that seems to affect “newer” accounts: librespot has become unreliable there. I’m affected by this myself, which also makes it harder to troubleshoot and validate fixes properly. I did a custom Spotify implementation myself that does not use librespot (more comparable to the Apple Music/Deezer providers). I’m considering switching to that implementation instead. I need some time to verify a few things first. If I decide to keep the current librespot-based path, I’ll fix the specific issue you’re seeing there.
Author
Owner

@rudyberends commented on GitHub (Feb 12, 2026):

Right, so it really is an easy fix. The callback needs to be;

https://lox-audioserver.github.io/lox-audioserver/spotify-callback/

If the trailing / is missing in your Spotify app settings, Spotify will reject the request due to a redirect URI mismatch. Adding the slash resolves the issue.

<!-- gh-comment-id:3892243461 --> @rudyberends commented on GitHub (Feb 12, 2026): Right, so it really is an easy fix. The callback needs to be; https://lox-audioserver.github.io/lox-audioserver/spotify-callback/ If the trailing / is missing in your Spotify app settings, Spotify will reject the request due to a redirect URI mismatch. Adding the slash resolves the issue.
Author
Owner

@wiking-at commented on GitHub (Feb 13, 2026):

thanks for the hint - the callback now works again.

<!-- gh-comment-id:3897035819 --> @wiking-at commented on GitHub (Feb 13, 2026): thanks for the hint - the callback now works again.
Author
Owner

@tobsch commented on GitHub (Feb 14, 2026):

For me the issue persists. - at least if I applied the fix correctly. I basically changed the url of the redirect in the javascript. Or is it only the spotify app side? Then @rudyberends would have to change it - for me at least :)

<!-- gh-comment-id:3901536492 --> @tobsch commented on GitHub (Feb 14, 2026): For me the issue persists. - at least if I applied the fix correctly. I basically changed the url of the redirect in the javascript. Or is it only the spotify app side? Then @rudyberends would have to change it - for me at least :)
Author
Owner

@rudyberends commented on GitHub (Feb 14, 2026):

For me the issue persists. - at least if I applied the fix correctly. I basically changed the url of the redirect in the javascript. Or is it only the spotify app side? Then @rudyberends would have to change it - for me at least :)

My app does not have the issue. It's only for newly created spotify apps. You do not have this specific problem. There is no need to change any code, it's just on the spotify app side.

Given the newest Spotify rules regarding apps, it would probably be best to create your own app now. Apps wil only work as long as the account has a premium subscription and mine expires within a month.

<!-- gh-comment-id:3901543185 --> @rudyberends commented on GitHub (Feb 14, 2026): > For me the issue persists. - at least if I applied the fix correctly. I basically changed the url of the redirect in the javascript. Or is it only the spotify app side? Then [@rudyberends](https://github.com/rudyberends) would have to change it - for me at least :) My app does not have the issue. It's only for newly created spotify apps. You do not have this specific problem. There is no need to change any code, it's just on the spotify app side. Given the newest Spotify rules regarding apps, it would probably be best to create your own app now. Apps wil only work as long as the account has a premium subscription and mine expires within a month.
Author
Owner

@tobsch commented on GitHub (Feb 14, 2026):

Thanks Rudy!
So, for me the issue is even the same when I use my own newly created spotify app.

<!-- gh-comment-id:3901815130 --> @tobsch commented on GitHub (Feb 14, 2026): Thanks Rudy! So, for me the issue is even the same when I use my own newly created spotify app.
Author
Owner

@rudyberends commented on GitHub (Feb 14, 2026):

Please read the thread carefully. Are you actually experiencing the same issue that wiking-at described? His problem was strictly related to the client ID redirect, which prevented him from adding a Spotify account in the first place. That is a completely different issue from the one you reported.

I explicitly mentioned in my reply to him that the redirect issue was a trivial fix, but that there were other, more serious Spotify-related problems. This is exactly why I keep emphasizing the need to clearly separate issues. They may appear similar (“Spotify doesn’t work for me”), but the underlying causes are entirely different.

I will resolve your issue. I already have a working version, but it’s currently more of a workaround and needs to be implemented properly. As mentioned earlier, I also have an alternative implementation that works better and does not rely on a Spotify Connect instance. It may even support lossless playback. However, I am cautious about releasing it, as I do not want to risk a Spotify takedown of the repository due to the Spotify-related code—especially since I do not personally use it.

<!-- gh-comment-id:3901850122 --> @rudyberends commented on GitHub (Feb 14, 2026): Please read the thread carefully. Are you actually experiencing the same issue that wiking-at described? His problem was strictly related to the client ID redirect, which prevented him from adding a Spotify account in the first place. That is a completely different issue from the one you reported. I explicitly mentioned in my reply to him that the redirect issue was a trivial fix, but that there were other, more serious Spotify-related problems. This is exactly why I keep emphasizing the need to clearly separate issues. They may appear similar (“Spotify doesn’t work for me”), but the underlying causes are entirely different. I will resolve your issue. I already have a working version, but it’s currently more of a workaround and needs to be implemented properly. As mentioned earlier, I also have an alternative implementation that works better and does not rely on a Spotify Connect instance. It may even support lossless playback. However, I am cautious about releasing it, as I do not want to risk a Spotify takedown of the repository due to the Spotify-related code—especially since I do not personally use it.
Author
Owner

@wiking-at commented on GitHub (Feb 15, 2026):

sorry for any confusion i might have introduced.

the redirect issue is fixed - but I'm also waiting for the other spotify fixes. with beta 5 I couldn't use spotify at all and radio streams had breaks every few seconds (i suppose because the zones are spotify connect enabled). i reverted my audio system to music assistant to be able to hear music again.

I personally would prefer if i could use zones also via spotify connect (as well as the loxone app) - as search suggestions etc. are much better implemented in the native spotify app then in the loxone app.

music assistant players directly mapped to zones in lox-audioserver would be quite usable - as this would shift the spotify account handling issues to music assistant. as you don't use spotify and need a premium account to do tests or use the spotify feature it might be hard to keep spotify working in lox-audioserver. or are you using libraries which implement necessairy changes in the api so you don't have to test the spotify implementation?

<!-- gh-comment-id:3905061090 --> @wiking-at commented on GitHub (Feb 15, 2026): sorry for any confusion i might have introduced. the redirect issue is fixed - but I'm also waiting for the other spotify fixes. with beta 5 I couldn't use spotify at all and radio streams had breaks every few seconds (i suppose because the zones are spotify connect enabled). i reverted my audio system to music assistant to be able to hear music again. I personally would prefer if i could use zones also via spotify connect (as well as the loxone app) - as search suggestions etc. are much better implemented in the native spotify app then in the loxone app. music assistant players directly mapped to zones in lox-audioserver would be quite usable - as this would shift the spotify account handling issues to music assistant. as you don't use spotify and need a premium account to do tests or use the spotify feature it might be hard to keep spotify working in lox-audioserver. or are you using libraries which implement necessairy changes in the api so you don't have to test the spotify implementation?
Author
Owner

@rudyberends commented on GitHub (Feb 15, 2026):

Try beta6

<!-- gh-comment-id:3905099114 --> @rudyberends commented on GitHub (Feb 15, 2026): Try beta6
Author
Owner

@tobsch commented on GitHub (Feb 21, 2026):

Seems that you solved it, @rudyberends - thank you!

<!-- gh-comment-id:3939584121 --> @tobsch commented on GitHub (Feb 21, 2026): Seems that you solved it, @rudyberends - thank you!
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/lox-audioserver#86
No description provided.