Skip to content

Add separate playback authorization - #451

Draft
adamcik wants to merge 1 commit into
mainfrom
playback-authentication
Draft

adamcik wants to merge 1 commit into
mainfrom
playback-authentication

Conversation

@adamcik

@adamcik adamcik commented Sep 23, 2026 •

Copy link
Copy Markdown
Member

Spotify’s public Web API credentials and librespot playback credentials are no longer interchangeable. Public Web API tokens now fail playback with INVALID_CREDENTIALS, while Spotify desktop-client credentials cannot be used with the public Web API.

This PR therefore adds a separate playback flow instead of weakening or reusing the Web PKCE architecture.

  • Run the bundled gstspotify-auth helper through mopidy spotify auth playback.
  • Store reusable librespot credentials separately in credentials-cache.
  • Stop passing public Web API access tokens to spotifyaudiosrc.
  • Report Web and playback authorization independently through auth status.
  • Reserve bare mopidy spotify auth for eventually coordinating both flows.
  • Keep logout responsible for clearing both local credential sets independently.

The separation is intentional: each credential remains limited to the Spotify interface for which it was issued.

@adamcik
adamcik added this pull request to stack #453 September 23, 2026 15:14
@adamcik
adamcik force-pushed the playback-authentication branch from 0bd99e6 to e77258c Compare September 23, 2026 21:30
@adamcik
adamcik force-pushed the playback-authentication branch 2 times, most recently from e135eef to 92a2e38 Compare September 24, 2026 20:57
@adamcik
adamcik force-pushed the playback-authentication branch from 92a2e38 to 65a1c65 Compare September 24, 2026 21:09
@adamcik
adamcik force-pushed the playback-authentication branch from 65a1c65 to 022a03e Compare September 24, 2026 21:23
@adamcik
adamcik force-pushed the playback-authentication branch from 022a03e to 7dc6891 Compare September 24, 2026 21:53
@adamcik
adamcik force-pushed the playback-authentication branch from 7dc6891 to 5cc9f6f Compare September 24, 2026 22:08
@adamcik
adamcik force-pushed the playback-authentication branch 2 times, most recently from b4909c4 to d5c2f17 Compare September 26, 2026 22:53
@adamcik
adamcik force-pushed the playback-authentication branch 2 times, most recently from 746ef35 to fe8ac93 Compare September 26, 2026 23:10
@adamcik
adamcik force-pushed the playback-authentication branch from fe8ac93 to e47dbb0 Compare September 27, 2026 08:45
@adamcik
adamcik force-pushed the playback-authentication branch from e47dbb0 to f2c431d Compare September 27, 2026 09:03
@adamcik
adamcik force-pushed the playback-authentication branch from f2c431d to 4f16e78 Compare September 27, 2026 09:15
@adamcik
adamcik force-pushed the playback-authentication branch from 4f16e78 to 72b4c0c Compare September 27, 2026 10:24
@jodal
jodal force-pushed the playback-authentication branch 2 times, most recently from d2d27a8 to a553c89 Compare October 3, 2026 12:28
@adamcik
adamcik force-pushed the playback-authentication branch from a553c89 to 7ce8546 Compare October 3, 2026 18:51
@adamcik
adamcik force-pushed the playback-authentication branch from 7ce8546 to 703bfd8 Compare October 4, 2026 19:29
@adamcik
adamcik force-pushed the playback-authentication branch from 703bfd8 to 9212035 Compare October 4, 2026 19:59
@adamcik
adamcik force-pushed the playback-authentication branch from 9212035 to fc8b3b9 Compare October 4, 2026 20:10
@adamcik
adamcik removed this pull request from stack #453 October 4, 2026 20:28
@adamcik
adamcik added this pull request to stack #455 October 4, 2026 20:30
@adamcik
adamcik force-pushed the playback-authentication branch from fc8b3b9 to 9a0752a Compare October 4, 2026 20:56
@adamcik
adamcik force-pushed the playback-authentication branch 2 times, most recently from 15cbfd7 to 9854d52 Compare October 4, 2026 21:25
@adamcik
adamcik force-pushed the playback-authentication branch from 9854d52 to e8c1e39 Compare October 4, 2026 21:44
@adamcik
adamcik force-pushed the playback-authentication branch from e8c1e39 to a03e3b9 Compare October 4, 2026 22:27
@adamcik
adamcik force-pushed the playback-authentication branch from a03e3b9 to 96544e1 Compare October 4, 2026 22:36
@jodal
jodal force-pushed the playback-authentication branch from 96544e1 to 92323e5 Compare October 5, 2026 21:54
Expose distinct commands and status for Spotify Web API and librespot playback credentials. Keep logout responsible for both stores while making their independent authorization state visible to users.
@jodal
jodal force-pushed the playback-authentication branch from 92323e5 to 7383c04 Compare October 5, 2026 22:07
Base automatically changed from authentication-docs to main October 6, 2026 07:31

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant