Spotify

Overview

The Spotify Web API lets you search the Spotify catalog, read track/album/artist metadata, manage playlists and users’ saved music, control playback, and fetch personalized recommendations. It is the standard way to build music integrations on top of Spotify.

Note: the listing URL (beta.developer.spotify.com) is outdated — the current docs live at developer.spotify.com/documentation/web-api.

Authentication (OAuth)

Two common flows:

1. Client Credentials — app-level access, enough for search & metadata:

curl -X POST "https://accounts.spotify.com/api/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET"

Returns an access token (valid ~1 hour). Use it as a Bearer token:

curl "https://api.spotify.com/v1/search?q=radiohead&type=track&limit=5" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

2. Authorization Code — user-level access (playlists, saved tracks, playback). Requires redirecting the user through Spotify’s consent page and exchanging the code for tokens. Refresh tokens keep access alive long-term.

Getting Started

1. Create a developer account and register an app at the Spotify Developer Dashboard.
2. Note the Client ID and Client Secret.
3. Pick the flow above based on whether you need user data.
4. Keep credentials server-side — never embed them in client code.

Rate Limits & Notes

• The Web API itself is free to use; rate limits apply per app (see the docs for current numbers).
• Access tokens expire after ~1 hour; use refresh tokens (Authorization Code flow) for long sessions.
• Playback control requires an active Spotify session (Premium for some endpoints).
• Always respect user privacy: only request the scopes you need.

FAQ

Is the Spotify Web API free? The API is free — you only need a Spotify developer account and a registered app. (A Spotify Premium user account is required for some playback features.)

Does it require OAuth? Yes — Spotify uses OAuth 2.0. Use Client Credentials for catalog data, Authorization Code for user data.

Can I call it from the browser? Not safely — the token must stay server-side. Call the API from your backend.