Authorization, is a base64 encoded string that contains the client ID and client secret keys.

We must also include the following HTTP headers: This value is used for validation only since there is no actual redirection.

redirect_uri, must exactly match the same value sent on the user authorization request (previous step).

code, is the authorization code returned on the previous step.grant_type, must always contain the value authorization_code.

The body of the request must be encoded in application/x-www-form-urlencoded The code from the previous step, we need to make a POST request to the Now that we have the authorization code, we must exchange it for tokens. You have our proposal to generate randomly generated strings. state, a randomly generated string to protect against attacks such as cross-site request forgery.Īlthough state is not mandatory, is highly recommended including one.Since we are running the project locally, our redirect URL will point to localhost:3000/auth/callback since all petitions are handled from the frontend. redirect_uri is the URL that Spotify's Authorization server will redirect once the access token is granted.We need permission for streaming, user-read-email and user-read-private for the Web Player SDK. scope, a space-separated list of actions that our app can be allowed to do on a user's behalf.client_id, is the Client ID of the application we have just created on the portal dashboard.response_type, is the credential that will be returned.Spotify account service with the following parameters: To do so, we need to send a GET request to the /authorize endpoint of the Grant our application access to their premium account. The first step is to redirect the user to a web page where they can choose to

Spotify app