[GH-ISSUE #719] HTTP Status: 429 #404

Open
opened 2026-02-28 14:32:47 +03:00 by kerem · 24 comments
Owner

Originally created by @babochyk on GitHub (Dec 23, 2025).
Original GitHub issue: https://github.com/jpochyla/psst/issues/719

Describe the bug
Upon launching psst, no tracks load, the sidebar says http status: 429, but the home page does.

To Reproduce
Launch psst
Click on any playlist on the home page or select any other page.

Expected behavior
The tracks and the sidebar should load tracks.

Screenshots
Image

Environment

  • OS: Arch Linux
  • Version: Continuous release (2025.12.20-ae4f16d)
    Image

Additional context
I switched to psst because ncspot started lagging.

Originally created by @babochyk on GitHub (Dec 23, 2025). Original GitHub issue: https://github.com/jpochyla/psst/issues/719 **Describe the bug** Upon launching psst, no tracks load, the sidebar says http status: 429, but the home page does. **To Reproduce** Launch psst Click on any playlist on the home page or select any other page. **Expected behavior** The tracks and the sidebar should load tracks. **Screenshots** <img width="955" height="1059" alt="Image" src="https://github.com/user-attachments/assets/9bd65725-344d-4f54-99d0-7dde71e02b81" /> **Environment** - OS: Arch Linux - Version: Continuous release (2025.12.20-ae4f16d) <img width="953" height="396" alt="Image" src="https://github.com/user-attachments/assets/54ea3f6e-e8f5-4899-be31-654a01444105" /> **Additional context** I switched to psst because ncspot started lagging.
Author
Owner

@jtaub commented on GitHub (Dec 23, 2025):

Same problem here on Ubuntu 25.10. Worked until latest pull. Official Spotify website and app are working without 429, so I don't think my account is being rate limited.

Image
<!-- gh-comment-id:3688218163 --> @jtaub commented on GitHub (Dec 23, 2025): Same problem here on Ubuntu 25.10. Worked until latest pull. Official Spotify website and app are working without 429, so I don't think my account is being rate limited. <img width="1132" height="545" alt="Image" src="https://github.com/user-attachments/assets/509a14ea-1235-4f3d-91e3-52fa03323c9f" />
Author
Owner

@AuryVaz commented on GitHub (Dec 23, 2025):

Same here, Arch Linux too.

Image Image
<!-- gh-comment-id:3688229583 --> @AuryVaz commented on GitHub (Dec 23, 2025): Same here, Arch Linux too. <img width="702" height="1012" alt="Image" src="https://github.com/user-attachments/assets/3c62f6e0-162f-47df-bd12-5e36b3dccacc" /> <img width="972" height="1032" alt="Image" src="https://github.com/user-attachments/assets/76589fe3-35bd-48bf-ab50-2e0ba429fa9a" />
Author
Owner

@notrudyyy commented on GitHub (Dec 24, 2025):

Happening on Fedora 43 KDE Plasma spin too.

<!-- gh-comment-id:3689844098 --> @notrudyyy commented on GitHub (Dec 24, 2025): Happening on Fedora 43 KDE Plasma spin too.
Author
Owner

@gslin commented on GitHub (Dec 24, 2025):

Maybe related to the latest Anna's Archive news as Spotify said they've implemented some safe-guard mechanisms.

<!-- gh-comment-id:3690167237 --> @gslin commented on GitHub (Dec 24, 2025): Maybe related to the latest Anna's Archive news as Spotify said they've implemented some safe-guard mechanisms.
Author
Owner

@notrudyyy commented on GitHub (Dec 24, 2025):

Maybe related to the latest Anna's Archive news as Spotify said they've implemented some safe-guard mechanisms.

Wow can't believe they did that. If the cost is me using the web player for a while so be it!

<!-- gh-comment-id:3690173943 --> @notrudyyy commented on GitHub (Dec 24, 2025): > Maybe related to the latest Anna's Archive news as Spotify said they've implemented some safe-guard mechanisms. Wow can't believe they did that. If the cost is me using the web player for a while so be it!
Author
Owner

@Pogodaanton commented on GitHub (Dec 24, 2025):

Related discussions:

https://github.com/hrkfdn/ncspot/issues/1757

https://github.com/aome510/spotify-player/issues/890

<!-- gh-comment-id:3690312846 --> @Pogodaanton commented on GitHub (Dec 24, 2025): Related discussions: https://github.com/hrkfdn/ncspot/issues/1757 https://github.com/aome510/spotify-player/issues/890
Author
Owner

@Cleboost commented on GitHub (Dec 25, 2025):

Same

Image
<!-- gh-comment-id:3690635043 --> @Cleboost commented on GitHub (Dec 25, 2025): Same <img width="1917" height="1078" alt="Image" src="https://github.com/user-attachments/assets/bcb97d13-a239-4bb0-a522-043a5c0ed826" />
Author
Owner

@monskov commented on GitHub (Dec 27, 2025):

same issue, on arch

Image
<!-- gh-comment-id:3694296881 --> @monskov commented on GitHub (Dec 27, 2025): same issue, on arch <img width="635" height="818" alt="Image" src="https://github.com/user-attachments/assets/77bcfcc6-4d59-4f5c-bfb8-6ab55e96d48e" />
Author
Owner

@timstapl commented on GitHub (Dec 28, 2025):

It looks like 429 from spotify is your api key being rate limited. Maybe adding a setting where users can provide their own api key, similar to the last.fm config, would be a decent workaround?

<!-- gh-comment-id:3694902864 --> @timstapl commented on GitHub (Dec 28, 2025): It looks like 429 from spotify is your api key being rate limited. Maybe adding a setting where users can provide their own api key, similar to the last.fm config, would be a decent workaround?
Author
Owner

@wizardwithcodehazard commented on GitHub (Dec 29, 2025):

I feel like its because of anna's archive doing the spotify meta data download sh..t. 429 means too many requests idk should get resolved or what's happening..

<!-- gh-comment-id:3696598991 --> @wizardwithcodehazard commented on GitHub (Dec 29, 2025): I feel like its because of anna's archive doing the spotify meta data download sh..t. 429 means too many requests idk should get resolved or what's happening..
Author
Owner

@Potherca commented on GitHub (Dec 29, 2025):

Oddly, this does not happen when using another client, like Riff. If the issue was with Spotify, I would expect to see 429s there too. 🤔

<!-- gh-comment-id:3697575233 --> @Potherca commented on GitHub (Dec 29, 2025): Oddly, this does not happen when using another client, like [Riff](https://github.com/Diegovsky/riff). If the issue was with Spotify, I would expect to see 429s there too. 🤔
Author
Owner

@Pogodaanton commented on GitHub (Jan 4, 2026):

Oddly, this does not happen when using another client, like Riff. If the issue was with Spotify, I would expect to see 429s there too. 🤔

Interesting...

Riff uses a custom client_id that was created when it was still maintained as spot. I did not know that you were able to register applications on Spotify that are granted the necessary scopes to use librespot-playback.

The auth token psst obtains seems to have been blocked for anything touching the api.spotify.com endpoint. For psst, this includes most requests in the GUI and metadata retrieval for playback. That's also why the home section on psst still works partially though: Those requests go to a different endpoint.

Resolving playback for psst with the current token is trivial. Accessing track lists with the current token, however, will require a change to a different endpoint. The pathfinder API, which is already used in the home section, could be a potential choice. It still works with the current token. As that API has a completely different output and barely any documentation, this might become a time-consuming do-over.

Alternatively, we could get a hold of a registered client_id that has streaming scopes among others and base (all) API requests on that. This would still require a change in how tokens are retrieved and refreshed (akin to #694). I don't know when and if obtaining such an ID is possible any time soon, as Spotify has (quietly?) paused application registrations for now.

Otherwise, 'bring your own api key' is also a viable option. However, that will be hard to test/use for people who don't have one (e.g. me), given that Spotify has paused paused application registrations for now.

<!-- gh-comment-id:3708142699 --> @Pogodaanton commented on GitHub (Jan 4, 2026): > Oddly, this does not happen when using another client, like [Riff](https://github.com/Diegovsky/riff). If the issue was with Spotify, I would expect to see 429s there too. 🤔 Interesting... Riff uses a custom `client_id` that was created when it was still maintained as `spot`. I did not know that you were able to register applications on Spotify that are granted the necessary scopes to use librespot-playback. The auth token psst obtains seems to have been blocked for anything touching the `api.spotify.com` endpoint. For psst, this includes most requests in the GUI and metadata retrieval for playback. That's also why the home section on psst still works partially though: Those requests go to a different endpoint. Resolving playback for psst with the current token is trivial. Accessing track lists with the current token, however, will require a change to a different endpoint. The pathfinder API, which is already used in the home section, could be a potential choice. It still works with the current token. As that API has a completely different output and barely any documentation, this might become a time-consuming do-over. Alternatively, we could get a hold of a registered `client_id` that has [streaming scopes](https://developer.spotify.com/documentation/web-api/concepts/scopes#streaming) among others and base (all) API requests on that. This would still require a change in how tokens are retrieved and refreshed (akin to #694). I don't know when and if obtaining such an ID is possible any time soon, as Spotify has (quietly?) [paused application registrations for now](https://developer.spotify.com/dashboard). Otherwise, 'bring your own api key' is also a viable option. However, that will be hard to test/use for people who don't have one (e.g. me), given that Spotify has paused [paused application registrations for now](https://developer.spotify.com/dashboard).
Author
Owner

@kingosticks commented on GitHub (Jan 4, 2026):

The (historical) problems with personal client IDs is they have more usage restrictions. Specifically, lower rate-limits and no access to some endpoints. But that's all moot if the traditional shared client ID has now been crippled in Spotify's latest hissy fit/panic.

<!-- gh-comment-id:3708260164 --> @kingosticks commented on GitHub (Jan 4, 2026): The (historical) problems with personal client IDs is they have more usage restrictions. Specifically, lower rate-limits and no access to some endpoints. But that's all moot if the traditional shared client ID has now been crippled in Spotify's latest hissy fit/panic.
Author
Owner

@jacksongoode commented on GitHub (Jan 5, 2026):

Yeah - I've been following and patiently waiting to see how other projects are approaching this. It might just mean adding some rate limiting to our requests to prevent this from happening.

Otherwise, 'bring your own api key' is also a viable option. However, that will be hard to test/use for people who don't have one (e.g. me), given that Spotify has paused paused application registrations for now.

@Pogodaanton Thanks for the investigation! I think given that Spotify might be making some changes re: api access, I think there will just be more and more work ahead until they make an announcement.

<!-- gh-comment-id:3708967221 --> @jacksongoode commented on GitHub (Jan 5, 2026): Yeah - I've been following and patiently waiting to see how other projects are approaching this. It might just mean adding some rate limiting to our requests to prevent this from happening. > Otherwise, 'bring your own api key' is also a viable option. However, that will be hard to test/use for people who don't have one (e.g. me), given that Spotify has paused [paused application registrations for now](https://developer.spotify.com/dashboard). @Pogodaanton Thanks for the investigation! I think given that Spotify might be making some changes re: api access, I think there will just be more and more work ahead until they make an announcement.
Author
Owner

@kingosticks commented on GitHub (Jan 8, 2026):

The (historical) problems with personal client IDs is they have more usage restrictions. Specifically, lower rate-limits and no access to some endpoints. But that's all moot if the traditional shared client ID has now been crippled in Spotify's latest hissy fit/panic.

It's also currently not possible to obtain a personal client ID, Spotify have quietly disabled new applications.

<!-- gh-comment-id:3723668395 --> @kingosticks commented on GitHub (Jan 8, 2026): > The (historical) problems with personal client IDs is they have more usage restrictions. Specifically, lower rate-limits and no access to some endpoints. But that's all moot if the traditional shared client ID has now been crippled in Spotify's latest hissy fit/panic. It's also currently not possible to obtain a personal client ID, Spotify have [quietly disabled new applications](https://community.spotify.com/t5/Spotify-for-Developers/Unable-to-create-app/td-p/7283365).
Author
Owner

@rublev commented on GitHub (Feb 13, 2026):

429 on macos too D:

<!-- gh-comment-id:3897782308 --> @rublev commented on GitHub (Feb 13, 2026): 429 on macos too D:
Author
Owner

@rmoeritz-alayacare commented on GitHub (Feb 19, 2026):

Yep, on starting Psst I immediately get a wall of 429s making it unusable 😢. What a shame (Ubuntu 24.04 x64).

<!-- gh-comment-id:3930553991 --> @rmoeritz-alayacare commented on GitHub (Feb 19, 2026): Yep, on starting Psst I immediately get a wall of 429s making it unusable 😢. What a shame (Ubuntu 24.04 x64).
Author
Owner

@evs-xsarus commented on GitHub (Feb 20, 2026):

The (historical) problems with personal client IDs is they have more usage restrictions. Specifically, lower rate-limits and no access to some endpoints. But that's all moot if the traditional shared client ID has now been crippled in Spotify's latest hissy fit/panic.

It's also currently not possible to obtain a personal client ID, Spotify have quietly disabled new applications.

This is possible again. Could psst be enhanced with the new URL Oauth https://developer.spotify.com/documentation/web-api/concepts/authorization

<!-- gh-comment-id:3935036777 --> @evs-xsarus commented on GitHub (Feb 20, 2026): > > The (historical) problems with personal client IDs is they have more usage restrictions. Specifically, lower rate-limits and no access to some endpoints. But that's all moot if the traditional shared client ID has now been crippled in Spotify's latest hissy fit/panic. > > It's also currently not possible to obtain a personal client ID, Spotify have [quietly disabled new applications](https://community.spotify.com/t5/Spotify-for-Developers/Unable-to-create-app/td-p/7283365). This is possible again. Could psst be enhanced with the new URL Oauth https://developer.spotify.com/documentation/web-api/concepts/authorization
Author
Owner

@ralph commented on GitHub (Feb 20, 2026):

Now that client id registrations are open again, Psst could be converted to bring-your-own-client-id, meaning each user must register her/his own client id on the Spotify developer dashboard. This will get rid of the 429s, but comes at the cost of more restrictions, as described here:

There is no easy solution for this, unfortunately. Spotify decided it doesn't need indie developers, so maybe indie developers will decide they don't need Spotify next ¯\_(ツ)_/¯.

<!-- gh-comment-id:3935503100 --> @ralph commented on GitHub (Feb 20, 2026): Now that client id registrations are open again, Psst could be converted to bring-your-own-client-id, meaning each user must register her/his own client id on the Spotify developer dashboard. This will get rid of the 429s, but comes at the cost of more restrictions, as described here: * https://github.com/jpochyla/psst/issues/719#issuecomment-3708260164 There is no easy solution for this, unfortunately. Spotify decided it doesn't need indie developers, so maybe indie developers will decide they don't need Spotify next `¯\_(ツ)_/¯`.
Author
Owner

@evs-xsarus commented on GitHub (Feb 20, 2026):

Maybe those limits are enough for us users. I've got the authentication working in these clients:

You might be able to borrow stuff from them.

<!-- gh-comment-id:3935670310 --> @evs-xsarus commented on GitHub (Feb 20, 2026): Maybe those limits are enough for us users. I've got the authentication working in these clients: * https://github.com/hrkfdn/ncspot * https://github.com/aome510/spotify-player * https://github.com/LargeModGames/spotatui You might be able to borrow stuff from them.
Author
Owner

@ralph commented on GitHub (Feb 20, 2026):

Also https://github.com/ralph/Spotifly if you prefer a GUI client 😇

<!-- gh-comment-id:3936631708 --> @ralph commented on GitHub (Feb 20, 2026): Also https://github.com/ralph/Spotifly if you prefer a GUI client 😇
Author
Owner

@Potherca commented on GitHub (Feb 20, 2026):

Also https://github.com/ralph/Spotifly if you prefer a GUI client 😇

... and are on mac. 😞

<!-- gh-comment-id:3936673904 --> @Potherca commented on GitHub (Feb 20, 2026): > Also https://github.com/ralph/Spotifly if you prefer a GUI client 😇 ... and are on mac. 😞
Author
Owner

@Pogodaanton commented on GitHub (Feb 21, 2026):

From what I can tell based on the way the announcement post was phrased, they'd prefer this project (and broadly most open source projects) to use a bring-your-own-key model.

Using developer keys should bring back most of psst's basic features like browsing and playback if clients like Spotifly work with the new keys. Stuff like credits and the home page will likely not be accessible anymore.

The only real hurdle right now is that the current authentication system in psst relies on tokens from login5 which will most likely not be accessible with developer keys. So we need to scrap login5 (🥲) and figure out a full OAuth refresh token based authentication system (akin to #694 ), so that we remove all reliance on the currently used client id. Then bring-your-own-key can be implemented.

Sadly I don't have the time to do this right now, so hopefully somebody can pick up the work based on the little explanation above

<!-- gh-comment-id:3938634476 --> @Pogodaanton commented on GitHub (Feb 21, 2026): From what I can tell based on the way the [announcement post](https://developer.spotify.com/blog/2026-02-06-update-on-developer-access-and-platform-security) was phrased, they'd prefer this project (and broadly most open source projects) to use a bring-your-own-key model. Using developer keys should bring back most of psst's basic features like browsing and playback if clients like [Spotifly](https://github.com/ralph/Spotifly) work with the new keys. Stuff like credits and the home page will likely not be accessible anymore. The only real hurdle right now is that the current authentication system in psst relies on tokens from login5 which will most likely not be accessible with developer keys. So we need to scrap login5 (🥲) and figure out a full OAuth refresh token based authentication system (akin to #694 ), so that we remove all reliance on the currently used client id. Then bring-your-own-key can be implemented. Sadly I don't have the time to do this right now, so hopefully somebody can pick up the work based on the little explanation above
Author
Owner

@grenaad commented on GitHub (Feb 21, 2026):

See pr here, this is based of work from @evs-xsarus, thank you for sharing that.

I did get it working, just need to add a client id, see the description.

<!-- gh-comment-id:3939095198 --> @grenaad commented on GitHub (Feb 21, 2026): See [pr](https://github.com/jpochyla/psst/pull/720) here, this is based of work from @evs-xsarus, thank you for sharing that. I did get it working, just need to add a client id, see the description.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/psst#404
No description provided.