"use strict";(self.webpackChunkspotify_api_docs=self.webpackChunkspotify_api_docs||[]).push([[4785],{3905:function(e,t,n){n.d(t,{Zo:function(){return c},kt:function(){return h}});var r=n(7294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function i(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var p=r.createContext({}),l=function(e){var t=r.useContext(p),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},c=function(e){var t=l(e.components);return r.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,p=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),d=l(n),h=o,f=d["".concat(p,".").concat(h)]||d[h]||u[h]||a;return n?r.createElement(f,i(i({ref:t},c),{},{components:n})):r.createElement(f,i({ref:t},c))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=d;var s={};for(var p in t)hasOwnProperty.call(t,p)&&(s[p]=t[p]);s.originalType=e,s.mdxType="string"==typeof e?e:o,i[1]=s;for(var l=2;l<a;l++)i[l]=n[l];return r.createElement.apply(null,i)}return r.createElement.apply(null,n)}d.displayName="MDXCreateElement"},4827:function(e,t,n){n.r(t),n.d(t,{assets:function(){return c},contentTitle:function(){return p},default:function(){return h},frontMatter:function(){return s},metadata:function(){return l},toc:function(){return u}});var r=n(7462),o=n(3366),a=(n(7294),n(3905)),i=["components"],s={id:"authorization_code",title:"Authorization Code"},p=void 0,l={unversionedId:"authorization_code",id:"authorization_code",title:"Authorization Code",description:"This flow is suitable for long-running applications in which the user grants permission only once. It provides an access token that can be refreshed. Since the token exchange involves sending your secret key, perform this on a secure location, like a backend service, and not from a client such as a browser or from a mobile app.",source:"@site/docs/authorization_code.md",sourceDirName:".",slug:"/authorization_code",permalink:"/SpotifyAPI-NET/docs/authorization_code",draft:!1,editUrl:"https://github.com/JohnnyCrazy/SpotifyAPI-NET/edit/master/SpotifyAPI.Docs/docs/authorization_code.md",tags:[],version:"current",lastUpdatedBy:"Jonas Dellinger",lastUpdatedAt:1668777595,formattedLastUpdatedAt:"Nov 18, 2022",frontMatter:{id:"authorization_code",title:"Authorization Code"},sidebar:"docs",previous:{title:"Implicit Grant",permalink:"/SpotifyAPI-NET/docs/implicit_grant"},next:{title:"PKCE",permalink:"/SpotifyAPI-NET/docs/pkce"}},c={},u=[{value:"Existing Web-Server",id:"existing-web-server",level:2},{value:"Using Spotify.Web.Auth",id:"using-spotifywebauth",level:2}],d={toc:u};function h(e){var t=e.components,n=(0,o.Z)(e,i);return(0,a.kt)("wrapper",(0,r.Z)({},d,n,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("blockquote",null,(0,a.kt)("p",{parentName:"blockquote"},"This flow is suitable for long-running applications in which the user grants permission only once. It provides an access token that can be refreshed. Since the token exchange involves sending your secret key, perform this on a secure location, like a backend service, and not from a client such as a browser or from a mobile app.")),(0,a.kt)("h2",{id:"existing-web-server"},"Existing Web-Server"),(0,a.kt)("p",null,"If you are already in control of a Web-Server (like ",(0,a.kt)("inlineCode",{parentName:"p"},"ASP.NET"),"), you can start the flow by generating a login uri:"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-csharp"},'// Make sure "http://localhost:5000" is in your applications redirect URIs!\nvar loginRequest = new LoginRequest(\n  new Uri("http://localhost:5000"),\n  "ClientId",\n  LoginRequest.ResponseType.Code\n)\n{\n  Scope = new[] { Scopes.PlaylistReadPrivate, Scopes.PlaylistReadCollaborative }\n};\nvar uri = loginRequest.ToUri();\n// Redirect user to uri via your favorite web-server\n')),(0,a.kt)("p",null,"When the user is redirected to the generated uri, they will have to login with their Spotify account and confirm that your application wants to access their user data. Once confirmed, they will be redirected to ",(0,a.kt)("inlineCode",{parentName:"p"},"http://localhost:5000")," and a ",(0,a.kt)("inlineCode",{parentName:"p"},"code")," parameter is attached to the query. This ",(0,a.kt)("inlineCode",{parentName:"p"},"code")," has to be exchanged for an ",(0,a.kt)("inlineCode",{parentName:"p"},"access_token")," and ",(0,a.kt)("inlineCode",{parentName:"p"},"refresh_token"),":"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-csharp"},'// This method should be called from your web-server when the user visits "http://localhost:5000"\npublic Task GetCallback(string code)\n{\n  var response = await new OAuthClient().RequestToken(\n    new AuthorizationCodeTokenRequest("ClientId", "ClientSecret", code, "http://localhost:5000")\n  );\n\n  var spotify = new SpotifyClient(response.AccessToken);\n  // Also important for later: response.RefreshToken\n}\n')),(0,a.kt)("p",null,"If the token expires at some point (check via ",(0,a.kt)("inlineCode",{parentName:"p"},"response.IsExpired"),"), you can refresh it:"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-csharp"},'var newResponse = await new OAuthClient().RequestToken(\n  new AuthorizationCodeRefreshRequest("ClientId", "ClientSecret", response.RefreshToken)\n);\n\nvar spotify = new SpotifyClient(newResponse.AccessToken);\n')),(0,a.kt)("p",null,"You can also let the ",(0,a.kt)("inlineCode",{parentName:"p"},"AuthorizationCodeAuthenticator")," take care of the refresh part:"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-csharp"},'var response = await new OAuthClient().RequestToken(\n  new AuthorizationCodeTokenRequest("ClientId", "ClientSecret", code, "http://localhost:5000")\n);\nvar config = SpotifyClientConfig\n  .CreateDefault()\n  .WithAuthenticator(new AuthorizationCodeAuthenticator("ClientId", "ClientSecret", response));\n\nvar spotify = new SpotifyClient(config);\n')),(0,a.kt)("p",null,"For a real example, have a look at ",(0,a.kt)("a",{parentName:"p",href:"https://github.com/JohnnyCrazy/SpotifyAPI-NET/tree/master/SpotifyAPI.Web.Examples/Example.ASP"},"Example.ASP"),". This also uses the great package ",(0,a.kt)("inlineCode",{parentName:"p"},"AspNet.Security.OAuth.Spotify")," which takes care of the OAuth flow inside of ",(0,a.kt)("inlineCode",{parentName:"p"},"ASP.NET"),"."),(0,a.kt)("h2",{id:"using-spotifywebauth"},"Using Spotify.Web.Auth"),(0,a.kt)("p",null,"For cross-platform CLI and desktop apps (non ",(0,a.kt)("inlineCode",{parentName:"p"},"UWP")," apps), ",(0,a.kt)("inlineCode",{parentName:"p"},"Spotify.Web.Auth")," can be used to supply a small embedded Web Server for the code retrieval."),(0,a.kt)("admonition",{type:"warning"},(0,a.kt)("p",{parentName:"admonition"},"Your client secret will be exposed when embedded in a desktop/CLI app. This can be abused and is not prefered. If possible, let the user create an application in the Spotify dashboard or let a server handle the Spotify communication.")),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-csharp"},'private static EmbedIOAuthServer _server;\n\npublic static async Task Main()\n{\n  // Make sure "http://localhost:5000/callback" is in your spotify application as redirect uri!\n  _server = new EmbedIOAuthServer(new Uri("http://localhost:5000/callback"), 5000);\n  await _server.Start();\n\n  _server.AuthorizationCodeReceived += OnAuthorizationCodeReceived;\n  _server.ErrorReceived += OnErrorReceived;\n\n  var request = new LoginRequest(_server.BaseUri, "ClientId", LoginRequest.ResponseType.Code)\n  {\n    Scope = new List<string> { Scopes.UserReadEmail }\n  };\n  BrowserUtil.Open(request.ToUri());\n}\n\nprivate static async Task OnAuthorizationCodeReceived(object sender, AuthorizationCodeResponse response)\n{\n  await _server.Stop();\n\n  var config = SpotifyClientConfig.CreateDefault();\n  var tokenResponse = await new OAuthClient(config).RequestToken(\n    new AuthorizationCodeTokenRequest(\n      "ClientId", "ClientSecret", response.Code, new Uri("http://localhost:5000/callback")\n    )\n  );\n\n  var spotify = new SpotifyClient(tokenResponse.AccessToken);\n  // do calls with Spotify and save token?\n}\n\nprivate static async Task OnErrorReceived(object sender, string error, string state)\n{\n  Console.WriteLine($"Aborting authorization, error received: {error}");\n  await _server.Stop();\n}\n')),(0,a.kt)("p",null,"For real examples, have a look at ",(0,a.kt)("a",{parentName:"p",href:"https://github.com/JohnnyCrazy/SpotifyAPI-NET/tree/master/SpotifyAPI.Web.Examples/Example.CLI.PersistentConfig"},"Example.CLI.PersistentConfig")," and ",(0,a.kt)("a",{parentName:"p",href:"https://github.com/JohnnyCrazy/SpotifyAPI-NET/tree/master/SpotifyAPI.Web.Examples/Example.CLI.CustomHTML"},"Example.CLI.CustomHTML")))}h.isMDXComponent=!0}}]);