INVALID_CLIENT: Insecure redirect URI

[VeraJunior]

Recently it doesn't work anymore, probably the last month or so I get the error: INVALID_CLIENT: Insecure redirect URI when I click the button 'Organize your music'.
This seems to be an issue with the connection to Spotify, since I get the same error on Sort Your Music when I try to login with my Spotify account.

[pbcoady]

Can confirm it's broken on my end as well. Seems like this page has some answers as to why: https://community.spotify.com/t5/Spotify-for-Developers/INVALID-CLIENT-Insecure-redirect-URI-using-custom-URI/td-p/6919036/page/2

[symphonic643]

Just ran into this myself, would appreciate a fix. Seems like it should be an easy fix but I don't personally have the knowhow to implement it.

[scottthomaswx]

Also occurring here... would love a fix as this is a great tool!

[elwynelwyn]

I cloned the project locally hoping to use the fix in #25 to run this thing myself. Unfortunately even with that fix, it still gives the same error for me locally redirecting to http://127.0.0.1:8000/

This project uses the implicit grant flow (response_type=token) which Spotify has deprecated and disabled for new apps. It needs to be migrated to Authorization Code with PKCE.

I attached a .patch file which does this change, and successfully allows me to authenticate my local instance.

auth-fix.patch

🤖 disclaimer, I am not too familiar with this project, the patch is LLM generated code 🤖

The next problem though was as soon as I started processing anything (a playlist, "my music" etc) it would load some data successfully but then fail on this API request: https://api.spotify.com/v1/audio-features. Ths is the API that returns all the actual metadata about tracks, "energy", "bpm" etc. It seems that this API is deprecated and unavailable for new spotify apps - unless you have something called "Extended quota mode" which requires being an application with 250k+ MAUs...

It seems like right now it is no longer possible to run this program locally unless you happen to already have an existing spotify application ID which was set up before this spotify policy change was made. If the redirect URLs are changed to https to avoid this Insecure redirect URI issue, the patch (or an actual better implementation of this fix) would unblock the auth flow. Presumably the existing OrganizeYourMusic application ID would continue to work fir the audio-features endpoint.

So looks like we need @plamere or another maintainer to get involved to get the project running again.

[plamere]

Hey all - thanks for the interest in this 10 year old program. I've updated all the bits and it should be live again at https://organizeyourmusic.playlistmachinery.com/

[elwynelwyn]

Thank you for the fix @plamere! This is such a useful tool, appreciate you taking the time to get it up and running again 🙏