Implement implicit grant flow

elliotwms / opml-to-spotify

Import OPML files into Spotify Podcasts, poorly

14 stars 0 forks source link

Implement implicit grant flow #4

Closed elliotwms closed 2 years ago

elliotwms commented 2 years ago

As the application is short-running, there's no need for a full authorisation code flow.

Implementing the implicit grant flow removes the requirement for a client-side secret, which means we can bundle the client ID into the application, and there's no need for users to create their own Spotify app

Requirements

[ ] Implement the implicit grant flow
[ ] Bundle the opml-to-spotify application client ID into the build (nice to have if Spotify approve the application)
[ ] Update the docs

elliotwms commented 2 years ago

Implicit grant bad https://oauth.net/2/grant-types/implicit/

Let's look at authorisation code flow with PKCE instead https://developer.spotify.com/documentation/general/guides/authorization/code-flow/