[GH-ISSUE #61] Move away from cookies for authentication #126

New issue

Closed

opened 2026-03-13 21:16:14 +03:00 by kerem · 3 comments

kerem commented

2026-03-13 21:16:14 +03:00

Owner

Originally created by @adhamali450 on GitHub (Feb 5, 2026).
Original GitHub issue: https://github.com/akashrchandran/spotify-lyrics-api/issues/61

Amazing project btw 👏

One concern though: for something that’s meant to be hosted on a server and run 24/7, relying on a browser session cookie like sp_dc feels a bit fragile. Since it can expire or get invalidated at any time, it’s hard to guarantee long-term stability.

Using OAuth tokens (or a similar official auth flow) that can be refreshed automatically would make this much more reliable and production-friendly.

If this is feasible but just hasn’t been tackled yet, I’d be happy to help contribute. I don’t write PHP much, but I’m definitely open to working on this together if that helps move things forward.

Originally created by @adhamali450 on GitHub (Feb 5, 2026). Original GitHub issue: https://github.com/akashrchandran/spotify-lyrics-api/issues/61 ### Amazing project btw 👏 One concern though: for something that’s meant to be hosted on a server and run 24/7, relying on a browser session cookie like `sp_dc` feels a bit fragile. Since it can expire or get invalidated at any time, it’s hard to guarantee long-term stability. Using OAuth tokens (or a similar official auth flow) that can be refreshed automatically would make this much more reliable and production-friendly. If this _is_ feasible but just hasn’t been tackled yet, I’d be happy to help contribute. I don’t write PHP much, but I’m definitely open to working on this together if that helps move things forward.

kerem closed this issue

2026-03-13 21:16:19 +03:00

kerem commented

2026-03-13 21:16:25 +03:00

Author

Owner

@adhamali450 commented on GitHub (Feb 5, 2026):

I have a project where I already get the lyrics from Genius (unofficially). The reason why this is far more interesting to me is that you get synced lyrics.
I need timestamps to sync the lyric bar with the bar from the recording.

@adhamali450 commented on GitHub (Feb 5, 2026): I have a project where I already get the lyrics from Genius (unofficially). The reason why this is far more interesting to me is that you get synced lyrics. I need timestamps to sync the lyric bar with the bar from the recording.

kerem commented

2026-03-13 21:16:30 +03:00

Author

Owner

@akashrchandran commented on GitHub (Feb 6, 2026):

The APIs used here are private Spotify web APIs, not the public ones that support official OAuth authorization flows.

These endpoints only work with a logged-in Spotify web session. Using the normal authorization flows would require automating Spotify’s login process, which is protected by CAPTCHA and other anti-bot checks, so it’s not realistically solvable.

Instead, this project uses session cookies from a real login. The cookies:

Give access to the required auth token
Are long-lived (often ~1 year)
Allow refreshing the token without re-logging in

Because of this, cookie-based auth is currently the only practical approach for accessing these endpoints.

@akashrchandran commented on GitHub (Feb 6, 2026): The APIs used here are private Spotify web APIs, not the public ones that support official OAuth authorization flows. These endpoints only work with a logged-in Spotify web session. Using the normal authorization flows would require automating Spotify’s login process, which is protected by CAPTCHA and other anti-bot checks, so it’s not realistically solvable. Instead, this project uses session cookies from a real login. The cookies: - Give access to the required auth token - Are long-lived (often ~1 year) - Allow refreshing the token without re-logging in Because of this, cookie-based auth is currently the only practical approach for accessing these endpoints.

kerem commented

2026-03-13 21:16:35 +03:00

Author

Owner

@adhamali450 commented on GitHub (Feb 7, 2026):

Just figured out yesterday that they're using the web player API which is different from the public one. Wanted to continue reverse-engineering the player to extract as many information as possible but couldn't work with PHP (I'm not a PHP guy tbh). Forked and re-wrote in Python.
I Will continue exploring their API. I'm more than happy to collaborate on this btw!

@adhamali450 commented on GitHub (Feb 7, 2026): Just figured out yesterday that they're using the web player API which is different from the public one. Wanted to continue reverse-engineering the player to extract as many information as possible but couldn't work with PHP (I'm not a PHP guy tbh). Forked and re-wrote in Python. I Will continue exploring their API. I'm more than happy to collaborate on this btw!