Research into Spotify Authorization

[m4ndycheung]

What we think Spotify Authorization:

• For our app to create playlists - We have a feeling we'll need to login to the Master Spotify Account i.e. get authorized
• For us to show a playlist from the Master Account on our website - can we get away with just using Client Credentials?

To Do:

• [x] Confirm what Authorization we need for creating playlists and adding songs to that playlist
• [x] Confirm what Authorization is needed to get playlist from the Master Account and display it on our website

Dev Notes:

• Which authorization flow should we use? https://developer.spotify.com/documentation/web-api/concepts/authorization
• Client Credentials: https://developer.spotify.com/documentation/web-api/tutorials/client-credentials-flow
• Client Credentials - we can’t access “User Resources” what’s a User Resource? So does that mean we can’t access a User’s playlist?
• Searching for songs on Spotify is when we would use CLient Credentials OAuth and we wouldn't need the Authorization Code Flow

[m4ndycheung]

I've tried this: https://www.viwizard.com/spotify-music-tips/embed-spotify-playlist-on-website.html, maybe it was obvious but we don't need authorization to see a playlist. The Client Credentials seem like a puzzle piece of the larger authorization picture I think 🤔.

[ManSangSin]

User Resources includes anything to do with a user such as:

• Profile data: username, profile pic, email address, followers
• user data: playlists

[ManSangSin]

Client Credentials required to use the Spotify API It allows access to the spotify data which does not relate to a user such as album, artist or song details stored on spotify

[ManSangSin]

Confirm what Authorization we need for creating playlists and adding songs to that playlist For adding songs to a playlist/creating a playlist using the API, we need access to the user resources so the authorisation code flow needs to be followed (https://developer.spotify.com/documentation/web-api/tutorials/code-flow)

Confirm what Authorization is needed to get playlist from the Master Account and display it on our website Since we are not using the API to get the playlist (using embed player), we do authorisation (as Mandy mentioned above)

[ManSangSin]

Authorization Code Flow

From the guide the only reason not to use the standard Authorisation Flow and opt for PKCE is when the Client secret cannot be stored safely. Since we can use .environment variables to store the secret so that they are not visible, it seems the standard flow can be used

[ManSangSin]

Possible issue we may have:

If we want to automate the add song/create playlist processes later, we may have issues with the authorisation code flow as we will be redirected to the spotify login before accepting and returning to the website.