[GH-ISSUE #806] Authentication fails with 403 Forbidden due to ignored/invalid client_id even after clean reinstall #478

New issue

Closed

opened 2026-03-02 23:47:56 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 23:47:56 +03:00

Owner

Originally created by @luizpassaroni on GitHub (Aug 23, 2025).
Original GitHub issue: https://github.com/aome510/spotify-player/issues/806

Describe the bug

The application fails to load any user data (playlists, albums, etc.) after a successful browser login, even after a complete "from scratch" reinstall. The UI remains empty and eventually crashes or errors out.

The root cause appears to be that the application's authentication request to Spotify's keymaster endpoint is using a default client_id that is consistently rejected with a 403 Forbidden error.

This issue persists even when a custom client_id and client_secret are correctly configured in app.toml. Previous logs showed that the application would load the custom client_id from the config file but still use the hardcoded default ID in the actual API request, indicating the configuration is being ignored at the authentication level.

Steps to Reproduce

On macOS, perform a complete removal of the application and all related files (brew uninstall, rm -rf ~/.config/spotify-player, rm -rf ~/.cache/spotify-player).
Reinstall spotify-player using Homebrew.
Configure app.toml with a valid, personal client_id and client_secret from the Spotify Developer Dashboard.
Ensure the correct Redirect URI (http://127.0.0.1:8989/login) is set in the Spotify App settings.
Run spotify-player.
Complete the authentication flow in the browser.
The application fails to load user data, and the logs show a 403 Forbidden error.

Expected behavior

The application should use the configured credentials, successfully retrieve an auth token, and load the user's library.

Actual behavior

The application fails to authenticate with Spotify's backend, resulting in an empty UI and preventing any use of the application.

Environment

OS: macOS
Installation Method: Homebrew

Logs

This log is from a fresh run after a complete reinstallation. All sensitive data has been redacted.

2025-08-23T19:05:32.746101Z  INFO spotify_player: Configurations: Configs { app_config: AppConfig { theme: "dracula", client_id: "[REDACTED]", ... }, cache_folder: "[REDACTED_HOME_DIR]/.cache/spotify-player" }
2025-08-23T19:05:32.751476Z  INFO spotify_player::auth: Using cached credentials
2025-08-23T19:05:33.532525Z  INFO librespot_core::session: Connecting to AP "ap-gue1.spotify.com:4070"
2025-08-23T19:05:34.122233Z  INFO librespot_core::session: Authenticated as '[REDACTED_USERNAME]' !
2025-08-23T19:05:34.122850Z  INFO librespot_core::session: Country: "BR"
2025-08-23T19:05:34.123047Z  INFO spotify_player::token: Getting a new authentication token...
2025-08-23T19:05:34.503788Z ERROR librespot_core::mercury: error 403 for uri hm://keymaster/token/authenticated?scope=...&client_id=[REDACTED]&device_id=[REDACTED]
2025-08-23T19:05:34.504065Z ERROR spotify_player::client::spotify: Failed to get a new token: failed to get the token: Service unavailable { error handling Mercury response: MercuryResponse { uri: "hm://keymaster/token/authenticated?scope=...&client_id=[REDACTED]&device_id=[REDACTED]", status_code: 403, payload: [[...]] } }
2025-08-23T19:05:34.504428Z  WARN spotify_player: Failed to create a client socket for handling CLI commands: Address already in use (os error 48)
2025-08-23T19:05:34.504471Z ERROR client_request{request=GetUserSavedShows}: spotify_player::client::handlers: Failed to handle client request: Token is not valid
2025-08-23T19:05:34.758683Z ERROR client_request{request=GetUserPlaylists}: spotify_player::client::handlers: Failed to handle client request: get access token: failed to get the authentication token stored inside the client.
2025-08-23T19:05:35.505234Z ERROR spotify_player::client: Failed to retrieve current playback: Token is not valid
2025-08-23T19:05:41.138121Z ERROR spotify_player::ui: Failed to render the application: Input/output error (os error 5)

Originally created by @luizpassaroni on GitHub (Aug 23, 2025). Original GitHub issue: https://github.com/aome510/spotify-player/issues/806 ### Describe the bug The application fails to load any user data (playlists, albums, etc.) after a successful browser login, even after a complete "from scratch" reinstall. The UI remains empty and eventually crashes or errors out. <img width="561" height="423" alt="Image" src="https://github.com/user-attachments/assets/b720c639-2afe-435a-bfdd-407d5d8dbd1a" /> The root cause appears to be that the application's authentication request to Spotify's `keymaster` endpoint is using a default `client_id` that is consistently rejected with a `403 Forbidden` error. This issue persists even when a custom `client_id` and `client_secret` are correctly configured in `app.toml`. Previous logs showed that the application would load the custom `client_id` from the config file but still use the hardcoded default ID in the actual API request, indicating the configuration is being ignored at the authentication level. ### Steps to Reproduce 1. On macOS, perform a complete removal of the application and all related files (`brew uninstall`, `rm -rf ~/.config/spotify-player`, `rm -rf ~/.cache/spotify-player`). 2. Reinstall `spotify-player` using Homebrew. 3. Configure `app.toml` with a valid, personal `client_id` and `client_secret` from the Spotify Developer Dashboard. 4. Ensure the correct `Redirect URI` (`http://127.0.0.1:8989/login`) is set in the Spotify App settings. 5. Run `spotify-player`. 6. Complete the authentication flow in the browser. 7. The application fails to load user data, and the logs show a `403 Forbidden` error. ### Expected behavior The application should use the configured credentials, successfully retrieve an auth token, and load the user's library. ### Actual behavior The application fails to authenticate with Spotify's backend, resulting in an empty UI and preventing any use of the application. ### Environment - **OS:** macOS - **Installation Method:** Homebrew ### Logs This log is from a fresh run after a complete reinstallation. All sensitive data has been redacted. ```log 2025-08-23T19:05:32.746101Z INFO spotify_player: Configurations: Configs { app_config: AppConfig { theme: "dracula", client_id: "[REDACTED]", ... }, cache_folder: "[REDACTED_HOME_DIR]/.cache/spotify-player" } 2025-08-23T19:05:32.751476Z INFO spotify_player::auth: Using cached credentials 2025-08-23T19:05:33.532525Z INFO librespot_core::session: Connecting to AP "ap-gue1.spotify.com:4070" 2025-08-23T19:05:34.122233Z INFO librespot_core::session: Authenticated as '[REDACTED_USERNAME]' ! 2025-08-23T19:05:34.122850Z INFO librespot_core::session: Country: "BR" 2025-08-23T19:05:34.123047Z INFO spotify_player::token: Getting a new authentication token... 2025-08-23T19:05:34.503788Z ERROR librespot_core::mercury: error 403 for uri hm://keymaster/token/authenticated?scope=...&client_id=[REDACTED]&device_id=[REDACTED] 2025-08-23T19:05:34.504065Z ERROR spotify_player::client::spotify: Failed to get a new token: failed to get the token: Service unavailable { error handling Mercury response: MercuryResponse { uri: "hm://keymaster/token/authenticated?scope=...&client_id=[REDACTED]&device_id=[REDACTED]", status_code: 403, payload: [[...]] } } 2025-08-23T19:05:34.504428Z WARN spotify_player: Failed to create a client socket for handling CLI commands: Address already in use (os error 48) 2025-08-23T19:05:34.504471Z ERROR client_request{request=GetUserSavedShows}: spotify_player::client::handlers: Failed to handle client request: Token is not valid 2025-08-23T19:05:34.758683Z ERROR client_request{request=GetUserPlaylists}: spotify_player::client::handlers: Failed to handle client request: get access token: failed to get the authentication token stored inside the client. 2025-08-23T19:05:35.505234Z ERROR spotify_player::client: Failed to retrieve current playback: Token is not valid 2025-08-23T19:05:41.138121Z ERROR spotify_player::ui: Failed to render the application: Input/output error (os error 5)