OAuth 2.0 · Authorization Code Flow

Spotify OAuth Flow

script → browser → spotify
script
browser
spotify
webbrowser.open(login URL) 1 GET /authorize 2 user logs in redirect localhost:8888?code=… 3 GET /callback?code=… 4 code captured POST /api/token (code) 5 access_token 6
script
browser
spotify
request / call
response / redirect
script
browser
spotify

Steps

1 webbrowser.open() The script constructs the /authorize URL with client_id, redirect_uri, scope, and state, then opens it in the system browser.
2 GET /authorize The browser sends the authorization request to Spotify. Spotify renders its login and consent screen; the user authenticates and approves the requested scopes.
3 redirect ?code=… After consent, Spotify redirects the browser to localhost:8888/callback with a short-lived authorization code in the query string.
4 GET /callback The local HTTP server running inside the script catches the callback request and extracts the code parameter from the URL.
5 POST /api/token The script exchanges the authorization code for tokens by POSTing client_id, client_secret, redirect_uri, and grant_type=authorization_code.
6 access_token Spotify returns access_token, refresh_token, expires_in, and token_type. Store the refresh token — it avoids repeating the full flow on expiry.