mirror of
https://github.com/mintlify/docs.git
synced 2026-09-14 13:35:46 +08:00
Mintlify Agent
65fd3621dc
- Created 111 MDX documentation files - Added 89 API endpoint pages across 14 categories - Included 11 concept guides and 7 tutorials - Configured Mintlify with Spotify branding (#1DB954) - All pages validated successfully
161 lines
5.0 KiB
Plaintext
161 lines
5.0 KiB
Plaintext
---
|
|
title: "Authentication flows"
|
|
description: "Learn about the different authentication flows available in the Spotify Web API"
|
|
---
|
|
|
|
# Authentication flows
|
|
|
|
The Spotify Web API uses OAuth 2.0 for authentication. Different flows are suitable for different application types. Choose the flow that best matches your use case.
|
|
|
|
## Available flows
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="Authorization Code Flow" icon="shield-check">
|
|
Best for server-side applications
|
|
</Card>
|
|
<Card title="Authorization Code with PKCE" icon="mobile">
|
|
Best for mobile and desktop apps
|
|
</Card>
|
|
<Card title="Client Credentials Flow" icon="server">
|
|
Best for server-to-server authentication
|
|
</Card>
|
|
<Card title="Implicit Grant Flow" icon="exclamation-triangle">
|
|
Deprecated - use PKCE instead
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
## Authorization Code Flow
|
|
|
|
**Use case**: Web apps running on a server
|
|
|
|
The Authorization Code Flow is suitable for long-running applications where the user grants permission only once. It provides an access token that can be refreshed.
|
|
|
|
### Characteristics
|
|
|
|
- Returns an access token and refresh token
|
|
- Requires client secret (keep it secure on your server)
|
|
- Most secure flow for web applications
|
|
- Tokens can be refreshed without user interaction
|
|
|
|
### When to use
|
|
|
|
Use this flow when:
|
|
- You have a server-side application
|
|
- You can securely store the client secret
|
|
- You need long-term access to user data
|
|
- You want to refresh tokens automatically
|
|
|
|
<Card title="Tutorial" icon="graduation-cap" href="/tutorials/authorization-code-flow">
|
|
Follow the Authorization Code Flow tutorial
|
|
</Card>
|
|
|
|
## Authorization Code Flow with PKCE
|
|
|
|
**Use case**: Mobile, desktop, and single-page applications
|
|
|
|
PKCE (Proof Key for Code Exchange) is an OAuth 2.0 extension that provides additional security for applications that cannot keep a client secret secure.
|
|
|
|
### Characteristics
|
|
|
|
- Does not require client secret
|
|
- Returns an access token and refresh token
|
|
- More secure for public clients
|
|
- Uses a code verifier and challenge
|
|
|
|
### When to use
|
|
|
|
Use this flow when:
|
|
- Building a mobile or desktop application
|
|
- Creating a single-page application (SPA)
|
|
- You cannot securely store client secrets
|
|
- You need refresh tokens
|
|
|
|
<Card title="Tutorial" icon="graduation-cap" href="/tutorials/authorization-code-pkce">
|
|
Follow the Authorization Code with PKCE tutorial
|
|
</Card>
|
|
|
|
## Client Credentials Flow
|
|
|
|
**Use case**: Server-to-server authentication
|
|
|
|
The Client Credentials Flow is used for server-to-server authentication. It doesn't require user permission or interaction.
|
|
|
|
### Characteristics
|
|
|
|
- No user authorization required
|
|
- Returns an access token (no refresh token)
|
|
- Can only access public Spotify data
|
|
- Token expires after a short period
|
|
|
|
### When to use
|
|
|
|
Use this flow when:
|
|
- You only need to access public Spotify data
|
|
- Your application doesn't require user-specific information
|
|
- Building server-side applications
|
|
- Creating background jobs or scripts
|
|
|
|
### Limitations
|
|
|
|
This flow cannot access user-specific endpoints like:
|
|
- Current user's playlists
|
|
- Saved tracks or albums
|
|
- Playback control
|
|
- User profile information
|
|
|
|
<Card title="Tutorial" icon="graduation-cap" href="/tutorials/client-credentials-flow">
|
|
Follow the Client Credentials Flow tutorial
|
|
</Card>
|
|
|
|
## Implicit Grant Flow (Deprecated)
|
|
|
|
<Warning>
|
|
The Implicit Grant Flow is deprecated. Use Authorization Code Flow with PKCE instead for client-side applications.
|
|
</Warning>
|
|
|
|
This flow was previously used for client-side applications but is now considered less secure. It returns an access token directly in the URL fragment, which can be exposed to potential attackers.
|
|
|
|
### Why it's deprecated
|
|
|
|
- Less secure than PKCE
|
|
- No refresh token support
|
|
- Token exposed in URL
|
|
- Not recommended by OAuth 2.0 best practices
|
|
|
|
<Card title="Migration guide" icon="arrow-right" href="/tutorials/authorization-code-pkce">
|
|
Migrate to Authorization Code with PKCE
|
|
</Card>
|
|
|
|
## Comparison table
|
|
|
|
| Flow | Client Secret Required | Refresh Token | Use Case | Security |
|
|
|------|----------------------|---------------|----------|----------|
|
|
| Authorization Code | Yes | Yes | Server-side web apps | High |
|
|
| Authorization Code with PKCE | No | Yes | Mobile, desktop, SPAs | High |
|
|
| Client Credentials | Yes | No | Server-to-server | Medium |
|
|
| Implicit Grant | No | No | Legacy SPAs | Low (Deprecated) |
|
|
|
|
## Access token lifetime
|
|
|
|
All access tokens expire after a short period (typically 1 hour). Depending on the flow:
|
|
|
|
- **Authorization Code** and **PKCE**: Use refresh tokens to get new access tokens
|
|
- **Client Credentials**: Request a new token when the current one expires
|
|
- **Implicit Grant**: User must re-authenticate (deprecated)
|
|
|
|
Learn more about [refreshing tokens](/tutorials/refreshing-tokens).
|
|
|
|
## Next steps
|
|
|
|
<CardGroup cols={3}>
|
|
<Card title="Access tokens" icon="key" href="/concepts/access-tokens">
|
|
Learn about access tokens
|
|
</Card>
|
|
<Card title="Scopes" icon="shield" href="/concepts/scopes">
|
|
Understand authorization scopes
|
|
</Card>
|
|
<Card title="Getting started tutorial" icon="book" href="/tutorials/getting-started">
|
|
Build your first app
|
|
</Card>
|
|
</CardGroup>
|