spotify

Spotify API Integration SOP

Control Spotify playback, manage playlists, search tracks, and fetch recommendations via the Spotify Web API.

When to Use

• User wants to search for tracks, albums, or artists on Spotify
• User wants to control playback (play, pause, skip, seek, volume)
• User wants to create, update, or manage playlists
• User wants to get track recommendations based on seeds
• User wants to fetch audio features (tempo, energy, danceability) for tracks

---

Part 1 — Auth Setup

Spotify uses OAuth 2.0. For personal/CLI use, Authorization Code + PKCE is preferred (no server needed). For server-side scripts, use Client Credentials (no user context, limited endpoints).

1. Create an App

1. Go to https://developer.spotify.com/dashboard
2. Click Create app → name it → set Redirect URI to http://localhost:8888/callback
3. Copy Client ID and Client Secret

2. Environment Variables

export SPOTIFY_CLIENT_ID="your_client_id"
export SPOTIFY_CLIENT_SECRET="your_client_secret"
export SPOTIFY_REDIRECT_URI="http://localhost:8888/callback"

Or in ~/.cowrangler/credentials.env:

SPOTIFY_CLIENT_ID=your_client_id
SPOTIFY_CLIENT_SECRET=your_client_secret
SPOTIFY_REDIRECT_URI=http://localhost:8888/callback

3. Client Credentials Token (no user context)

Grants access to public data: search, catalog, audio features. Does not allow playback control or playlist writes.

TOKEN=$(curl -s -X POST "https://accounts.spotify.com/api/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=${SPOTIFY_CLIENT_ID}&client_secret=${SPOTIFY_CLIENT_SECRET}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

echo "Token: $TOKEN"

4. Authorization Code Flow (user context — full access)

#!/usr/bin/env python3
"""get_spotify_token.py — run once to obtain a refresh token."""
import os, json, hashlib, base64, secrets, urllib.parse, urllib.request, http.server

CLIENT_ID     = os.environ["SPOTIFY_CLIENT_ID"]
CLIENT_SECRET = os.environ["SPOTIFY_CLIENT_SECRET"]
REDIRECT_URI  = os.environ.get("SPOTIFY_REDIRECT_URI", "http://localhost:8888/callback")
SCOPES        = " ".join([
    "user-read-playback-state",
    "user-modify-playback-state",
    "user-read-currently-playing",
    "playlist-read-private",
    "playlist-modify-public",
    "playlist-modify-private",
])

# Step 1 — Build auth URL
verifier = secrets.token_urlsafe(64)
challenge = base64.urlsafe_b64encode(
    hashlib.sha256(verifier.encode()).digest()
).rstrip(b"=").decode()

params = urllib.parse.urlencode({
    "client_id": CLIENT_ID, "response_type": "code",
    "redirect_uri": REDIRECT_URI, "scope": SCOPES,
    "code_challenge_method": "S256", "code_challenge": challenge,
})
print(f"Open this URL:\nhttps://accounts.spotify.com/authorize?{params}\n")

# Step 2 — Catch redirect
code = input("Paste the `code` query param from the redirect URL: ").strip()

# Step 3 — Exchange for tokens
body = urllib.parse.urlencode({
    "grant_type": "authorization_code", "code": code,
    "redirect_uri": REDIRECT_URI, "client_id": CLIENT_ID,
    "code_verifier": verifier,
}).encode()
req = urllib.request.Request(
    "https://accounts.spotify.com/api/token", data=body,
    headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST"
)
with urllib.request.urlopen(req) as r:
    tokens = json.load(r)

print("\nAdd to credentials.env:")
print(f"SPOTIFY_ACCESS_TOKEN={tokens['access_token']}")
print(f"SPOTIFY_REFRESH_TOKEN={tokens['refresh_token']}")