You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: SpotifyAPI.Docs/versioned_docs/version-5.1.1/auth/token_swap.md
+11-4Lines changed: 11 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,17 +11,18 @@ requests to Spotify, as well as requests that return back to the "server URI".
11
11
12
12
The exchange server **must** be able to:
13
13
14
-
* Return the authorization code from Spotify API authenticate page via GET request to the "server URI".
15
-
* Request the token response object via POST to the Spotify API token page.
16
-
* Request a refreshed token response object via POST to the Spotify API token page.
14
+
- Return the authorization code from Spotify API authenticate page via GET request to the "server URI".
15
+
- Request the token response object via POST to the Spotify API token page.
16
+
- Request a refreshed token response object via POST to the Spotify API token page.
17
17
18
18
**The good news is that you do not need to code it yourself.**
19
19
20
-
The advantages of this method are that the client ID and redirect URI are very well hidden and almost unexposed, but more importantly, your client secret is **never** exposed and is completely hidden compared to other methods (excluding [ImplicitGrantAuth](/SpotifyWebAPI/auth#implicitgrantauth)
20
+
The advantages of this method are that the client ID and redirect URI are very well hidden and almost unexposed, but more importantly, your client secret is **never** exposed and is completely hidden compared to other methods (excluding [ImplicitGrantAuth](implicit_grant.md)
21
21
as it does not deal with a client secret). This means
22
22
your Spotify app **cannot** be spoofed by a malicious third party.
23
23
24
24
## Using TokenSwapWebAPIFactory
25
+
25
26
The TokenSwapWebAPIFactory will create and configure a SpotifyWebAPI object for you.
26
27
27
28
It does this through the method GetWebApiAsync **asynchronously**, which means it will not halt execution of your program while obtaining it for you. If you would like to halt execution, which is **synchronous**, use `GetWebApiAsync().Result` without using **await**.
@@ -55,6 +56,7 @@ catch (Exception ex)
55
56
```
56
57
57
58
## Using TokenSwapAuth
59
+
58
60
Since the TokenSwapWebAPIFactory not only simplifies the whole process but offers additional functionality too
59
61
(such as AutoRefresh and AuthSuccess AuthFailure events), use of this way is very verbose and is only
60
62
recommended if you are having issues with TokenSwapWebAPIFactory or need access to the tokens.
@@ -84,25 +86,30 @@ auth.OpenBrowser();
84
86
```
85
87
86
88
## Token Swap Endpoint
89
+
87
90
To keep your client secret completely secure and your client ID and redirect URI as secure as possible, use of a web server (such as a php website) is required.
88
91
89
92
To use this method, an external HTTP Server (that you may need to create) needs to be able to supply the following HTTP Endpoints to your application:
90
93
91
94
`/swap` - Swaps out an `authorization_code` with an `access_token` and `refresh_token` - The following parameters are required in the JSON POST Body:
95
+
92
96
-`grant_type` (set to `"authorization_code"`)
93
97
-`code` (the `authorization_code`)
94
98
-`redirect_uri`
95
99
--**Important** The page that the redirect URI links to must return the authorization code json to your `serverUri` (default is 'http://localhost:4002') but to the folder 'auth', like this: 'http://localhost:4002/auth'.
96
100
97
101
`/refresh` - Refreshes an `access_token` - The following parameters are required in the JSON POST Body:
102
+
98
103
-`grant_type` (set to `"refresh_token"`)
99
104
-`refresh_token`
100
105
101
106
The following open-source token swap endpoint code can be used for your website:
It should be noted that GitHub Pages does not support hosting php scripts. Hosting php scripts through it will cause the php to render as plain HTML, potentially compromising your client secret while doing absolutely nothing.
107
114
108
115
Be sure you have whitelisted your redirect uri in the Spotify Developer Dashboard otherwise the authorization will always fail.
0 commit comments