[GH-ISSUE #510] Client side app, getting users to make developer accounts #305

New issue

Closed

opened 2026-02-27 23:21:54 +03:00 by kerem · 4 comments

kerem commented

2026-02-27 23:21:54 +03:00

Owner

Originally created by @jessfdm-codes on GitHub (Jun 7, 2020).
Original GitHub issue: https://github.com/spotipy-dev/spotipy/issues/510

Hi,

I'm looking to make a mod for a game which allows you to, in limited ways, control your local Spotify Desktop application (so not actually streaming just sending playback commands).

The issue I'm facing is this:
I'd need to authenticate the user somehow and I plan on bascially running spotipy as an install script outside the game to authenticate the user then grabbing the tokens and putting them somewhere the mod's code can get to.

Since this will obviously be a client side program if I used my developer secret token anyone could grab it from the source code. So my question was if it's possible under Spotify's terms to get users to generate their own developer accounts and use their client secret which they paste in as part of the install script? Is this unfairly circumventing rate limiting?

Originally created by @jessfdm-codes on GitHub (Jun 7, 2020). Original GitHub issue: https://github.com/spotipy-dev/spotipy/issues/510 Hi, I'm looking to make a mod for a game which allows you to, in limited ways, control your local Spotify Desktop application (so not actually streaming just sending playback commands). The issue I'm facing is this: I'd need to authenticate the user somehow and I plan on bascially running spotipy as an install script outside the game to authenticate the user then grabbing the tokens and putting them somewhere the mod's code can get to. Since this will obviously be a client side program if I used my developer secret token anyone could grab it from the source code. So my question was if it's possible under Spotify's terms to get users to generate their own developer accounts and use their client secret which they paste in as part of the install script? Is this unfairly circumventing rate limiting?

kerem

2026-02-27 23:21:54 +03:00

closed this issue
added the
question

implicit-grant-flow
labels

kerem commented

2026-02-27 23:21:55 +03:00

Author

Owner

@stephanebruckert commented on GitHub (Jun 7, 2020):

Hey @thomasfdm,

My guess is that asking users to create their own app wouldn't be a problem but this is something you should confirm by asking on https://community.spotify.com/t5/Spotify-for-Developers/bd-p/Spotify_Developer

The Implicit Grant Flow can be another possibility for you. It would let users use your Spotify app without sharing the secret. However this has yet to be implemented

@stephanebruckert commented on GitHub (Jun 7, 2020): Hey @thomasfdm, My guess is that asking users to create their own app wouldn't be a problem but this is something you should confirm by asking on https://community.spotify.com/t5/Spotify-for-Developers/bd-p/Spotify_Developer The [Implicit Grant Flow](https://github.com/plamere/spotipy/issues/499) can be another possibility for you. It would let users use your Spotify app without sharing the secret. However this has yet to be implemented

kerem commented

2026-02-27 23:21:55 +03:00

Author

Owner

@jessfdm-codes commented on GitHub (Jun 7, 2020):

Cool, I'll drop them an ask, and I'll have a look at implicit granting. Also, is there any general recommendations for how to store user tockens on disk that's accessible by multiple programs?

@jessfdm-codes commented on GitHub (Jun 7, 2020): Cool, I'll drop them an ask, and I'll have a look at implicit granting. Also, is there any general recommendations for how to store user tockens on disk that's accessible by multiple programs?

kerem commented

2026-02-27 23:21:55 +03:00

Author

Owner

@DJSdev commented on GitHub (Jul 19, 2020):

If pull request #542 is accepted, using the SpotifyPCKE auth-manager, users will be able to authorize your app without needing to reveal/store your client secret within the app. This is the Spotify's preferred method for authorization.

@DJSdev commented on GitHub (Jul 19, 2020): If pull request #542 is accepted, using the SpotifyPCKE auth-manager, users will be able to authorize your app without needing to reveal/store your client secret within the app. This is the Spotify's preferred method for authorization.

kerem commented

2026-02-27 23:21:55 +03:00

Author

Owner

@stephanebruckert commented on GitHub (Aug 30, 2020):

Going to close this as you can now use the PKCE auth manager as explained by @DJSdev

@stephanebruckert commented on GitHub (Aug 30, 2020): Going to close this as you can now use the PKCE auth manager as explained by @DJSdev