|
| 1 | +#Auth-Methods |
| 2 | + |
| 3 | +Before you can use the Web API full functional, you need the user to authenticate your Application. |
| 4 | +If you want to know more, you can read to the whole auth-process [here](https://developer.spotify.com/web-api/authorization-guide/). |
| 5 | + |
| 6 | +Before you start, you need to create a Application at Spotify: [Your Applications](https://developer.spotify.com/my-applications/#!/applications) |
| 7 | + |
| 8 | +*** |
| 9 | + |
| 10 | +After you created your Application, you will have following important values: |
| 11 | +>**Client_Id** This is your client_id, you don't have to hide it |
| 12 | +>**Client_Secret** Never use this in one of your client-side apps!! Keep it secret! |
| 13 | +>**Redirect URIs** Add "http://localhost", if you want full support for this API |
| 14 | +
|
| 15 | +Now you can start with the User-authentication, Spotify provides 3 ways: |
| 16 | + |
| 17 | +* [ImplicitGrantAuth](/SpotifyWebAPI/auth#implicitgrantauth) (**Recommended**, no server-side code needed) |
| 18 | + |
| 19 | +* [AutorizationCodeAuth](/SpotifyWebAPI/auth#autorizationcodeauth) (Not Recommended, Server-side code needed, else it's unsecure) |
| 20 | + |
| 21 | +* [ClientCredentialsAuth](/SpotifyWebAPI/auth#clientcredentialsauth) (Not Recommended, Server-side code needed, else it's unsecure) |
| 22 | + |
| 23 | +**Note:** I would recommend a little PHP Script, which will exchange the Keys using AutorizationCodeAuth. |
| 24 | +When using ImplicitGrantAuth, another user could abuse the "localhost" RedirectUri by creating a "fake"-app which uses your ClientId. |
| 25 | + |
| 26 | +Overview: |
| 27 | + |
| 28 | + |
| 29 | +After implementing one of the provided auth-methods, you can start doing requests with the token you get from one of the auth-methods |
| 30 | + |
| 31 | +##ImplicitGrantAuth |
| 32 | + |
| 33 | +This way is **recommended** and the only auth-process, which does not need a server-side exchange of keys. With this approach, you directly get a Token object after the user authed your application. |
| 34 | +You won't be able to refresh the token. If you want to use the internal Http server, please add "http://localhost" to your application redirects. |
| 35 | + |
| 36 | +More info: [here](https://developer.spotify.com/web-api/authorization-guide/#implicit_grant_flow) |
| 37 | + |
| 38 | +For this kind of authentication, there is also a `WebAPIFactory`, it's easier to use and uses an async method: |
| 39 | +``` |
| 40 | +static async void Main(string[] args) |
| 41 | +{ |
| 42 | + WebAPIFactory webApiFactory = new WebAPIFactory( |
| 43 | + "http://localhost", |
| 44 | + 8000, |
| 45 | + "XXXXXXXXXXXXXXXX", |
| 46 | + Scope.UserReadPrivate, |
| 47 | + TimeSpan.FromSeconds(20) |
| 48 | + ); |
| 49 | +
|
| 50 | + try |
| 51 | + { |
| 52 | + //This will open the user's browser and returns once |
| 53 | + //the user is authorized. |
| 54 | + _spotify = await webApiFactory.GetWebApi(); |
| 55 | + } |
| 56 | + catch (Exception ex) |
| 57 | + { |
| 58 | + MessageBox.Show(ex.Message); |
| 59 | + } |
| 60 | +
|
| 61 | + if (_spotify == null) |
| 62 | + return; |
| 63 | +} |
| 64 | +``` |
| 65 | + |
| 66 | +The old way: |
| 67 | +``` |
| 68 | +static ImplicitGrantAuth auth; |
| 69 | +static void Main(string[] args) |
| 70 | +{ |
| 71 | + //Create the auth object |
| 72 | + auth = new ImplicitGrantAuth() |
| 73 | + { |
| 74 | + //Your client Id |
| 75 | + ClientId = "XXXXXXXXXXXXXXXX", |
| 76 | + //Set this to localhost if you want to use the built-in HTTP Server |
| 77 | + RedirectUri = "http://localhost", |
| 78 | + //How many permissions we need? |
| 79 | + Scope = Scope.USER_READ_PRIVATE, |
| 80 | + }; |
| 81 | + //Start the internal http server |
| 82 | + auth.StartHttpServer(); |
| 83 | + //When we got our response |
| 84 | + auth.OnResponseReceivedEvent += auth_OnResponseReceivedEvent; |
| 85 | + //Start |
| 86 | + auth.DoAuth(); |
| 87 | +} |
| 88 | +
|
| 89 | +static void auth_OnResponseReceivedEvent(Token token, string state, string error) |
| 90 | +{ |
| 91 | + //stop the http server |
| 92 | + auth.StopHttpServer(); |
| 93 | +
|
| 94 | + var spotify = new SpotifyWebApiClass() |
| 95 | + { |
| 96 | + TokenType = token.TokenType, |
| 97 | + AccessToken = token.AccessToken |
| 98 | + }; |
| 99 | + //We can now make calls with the token object |
| 100 | +} |
| 101 | +``` |
| 102 | + |
| 103 | +##AutorizationCodeAuth |
| 104 | + |
| 105 | +This way is **not recommended** and requires server-side code to run securely. |
| 106 | +With this approach, you first get a code which you need to trade against the access-token. |
| 107 | +In this exchange you need to provide your Client-Secret and because of that it's not recommended. |
| 108 | +(But you can e.g exchange to codes via a PHP Script) |
| 109 | +A good thing about this method: You can always refresh your token, without having the user to auth it again |
| 110 | + |
| 111 | +More info: [here](https://developer.spotify.com/web-api/authorization-guide/#authorization_code_flow) |
| 112 | + |
| 113 | +``` |
| 114 | +static AutorizationCodeAuth auth; |
| 115 | +static void Main(string[] args) |
| 116 | +{ |
| 117 | + //Create the auth object |
| 118 | + auth = new AutorizationCodeAuth() |
| 119 | + { |
| 120 | + //Your client Id |
| 121 | + ClientId = "XXXXXXXXXXXXXXX", |
| 122 | + //Set this to localhost if you want to use the built-in HTTP Server |
| 123 | + RedirectUri = "http://localhost", |
| 124 | + //How many permissions we need? |
| 125 | + Scope = Scope.USER_READ_PRIVATE, |
| 126 | + }; |
| 127 | + //This will be called, if the user cancled/accept the auth-request |
| 128 | + auth.OnResponseReceivedEvent += auth_OnResponseReceivedEvent; |
| 129 | + //a local HTTP Server will be started (Needed for the response) |
| 130 | + auth.StartHttpServer(); |
| 131 | + //This will open the spotify auth-page. The user can decline/accept the request |
| 132 | + auth.DoAuth(); |
| 133 | +
|
| 134 | + Thread.Sleep(60000); |
| 135 | + auth.StopHttpServer(); |
| 136 | + Console.WriteLine("Too long, didnt respond, exiting now..."); |
| 137 | +} |
| 138 | +
|
| 139 | +private static void auth_OnResponseReceivedEvent(AutorizationCodeAuthResponse response) |
| 140 | +{ |
| 141 | + //Stop the HTTP Server, done. |
| 142 | + auth.StopHttpServer(); |
| 143 | +
|
| 144 | + //NEVER DO THIS! You would need to provide the ClientSecret. |
| 145 | + //You would need to do it e.g via a PHP-Script. |
| 146 | + Token token = auth.ExchangeAuthCode(response.Code, "XXXXXXXXXXX"); |
| 147 | +
|
| 148 | + var spotify = new SpotifyWebApiClass() |
| 149 | + { |
| 150 | + TokenType = token.TokenType, |
| 151 | + AccessToken = token.AccessToken |
| 152 | + }; |
| 153 | +
|
| 154 | + //With the token object, you can now make API calls |
| 155 | +} |
| 156 | +``` |
| 157 | + |
| 158 | +##ClientCredentialsAuth |
| 159 | + |
| 160 | +This way is **not recommended** and requires server-side code to run securely. |
| 161 | +With this approach, you make a POST Request with a base64 encoded string (consists of ClientId + ClientSecret). You will directly get the token (Without a local HTTP Server), but it will expire and can't be refreshed. |
| 162 | +If you want to use it securely, you would need to do it all server-side. |
| 163 | +**NOTE:** You will only be able to query non-user-related information e.g search for a Track. |
| 164 | + |
| 165 | +More info: [here](https://developer.spotify.com/web-api/authorization-guide/#client_credentials_flow) |
| 166 | + |
| 167 | +``` |
| 168 | +static ClientCredentialsAuth auth; |
| 169 | +static void Main(string[] args) |
| 170 | +{ |
| 171 | + //Create the auth object |
| 172 | + auth = new ClientCredentialsAuth() |
| 173 | + { |
| 174 | + //Your client Id |
| 175 | + ClientId = "XXXXXXXXXXXXXXX", |
| 176 | + //Your client secret UNSECURE!! |
| 177 | + ClientSecret = "XXXXXXXXXXXX", |
| 178 | + //How many permissions we need? |
| 179 | + Scope = Scope.USER_READ_PRIVATE, |
| 180 | + }; |
| 181 | + //With this token object, we now can make calls |
| 182 | + Token token = auth.DoAuth(); |
| 183 | + var spotify = new SpotifyWebApiClass() |
| 184 | + { |
| 185 | + TokenType = token.TokenType, |
| 186 | + AccessToken = token.AccessToken, |
| 187 | + UseAuth = false |
| 188 | + }; |
| 189 | +} |
| 190 | +``` |
| 191 | + |
| 192 | +#Scopes |
0 commit comments