Get Spotify Access Token (client credentials) with PHP and cURL

getSpotifyAccessToken

<?php

$client_id = '<insert your spotify app client id>'; 
$client_secret = '<insert your spotify app client secret>'; 

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,            'https://accounts.spotify.com/api/token' );
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt($ch, CURLOPT_POST,           1 );
curl_setopt($ch, CURLOPT_POSTFIELDS,     'grant_type=client_credentials' ); 
curl_setopt($ch, CURLOPT_HTTPHEADER,     array('Authorization: Basic '.base64_encode($client_id.':'.$client_secret))); 

$result=curl_exec($ch);
echo $result;

?>

I know it's basic, but I struggled to figure out how to retrieve the access token from the Spotify web service as the only example provided by Spotify was written in node.js. Hopefully this will save you the time and hassle I went through to get this simple script to work. :)

Excellent

thanks. i was struggling too.

thank you!

thank you!

I was very stressful owing to Spotify Oauth.
Many Thanks.
🥇

Thanks, still working. You made my day easier, I was going to use a library for cURL then I found this.

Does this still work? - It does not seem to work for me! Can somebody else try?

Thank you a lot! It worked perfectly for me!

Thank you so much !!!!

Nice!

Thank you!

Thanks much!

I have an error:

HTTP/1.1 400 Bad Request
www-authenticate: Bearer realm="spotify", error="invalid_request", error_description="Only valid bearer authentication supported"
access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-type: application/json
Content-Length: 99
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sun, 06 Sep 2020 01:49:21 GMT
server: envoy
Via: HTTP/2 edgeproxy, 1.1 google
Alt-Svc: clear

{
  "error": {
    "status": 400,
    "message": "Only valid bearer authentication supported"
  }
}

Who can help me?

it means you don't have a valid token to access the api. you need to register at spotify developers and use this token

…

On Sun, 6 Sep 2020 at 04:46, alamaxjashek ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ I have an error: HTTP/1.1 400 Bad Request www-authenticate: Bearer realm="spotify", error="invalid_request", error_description="Only valid bearer authentication supported" access-control-allow-origin: * access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH access-control-allow-credentials: true access-control-max-age: 604800 content-type: application/json Content-Length: 99 strict-transport-security: max-age=31536000 x-content-type-options: nosniff date: Sun, 06 Sep 2020 01:49:21 GMT server: envoy Via: HTTP/2 edgeproxy, 1.1 google Alt-Svc: clear { "error": { "status": 400, "message": "Only valid bearer authentication supported" } } Who can help me? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://gist.github.com/4aac6d048742d5de0e65#gistcomment-3443459>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANCB6TNKEJE4AY3MOMFOTVLSELZYPANCNFSM4H4XBOXA> .

How do I add the scope?

$scopes = array( 'user-read-playback-state', 'user-read-playback-position' );

Hi @ahallora your gist helped me a lot, thank you very much!

But I spent some time to translate it into nodejs, I made a gist like you: https://gist.github.com/owalid/cf7a2425d9733b6aee80832f6fbc660c

Do not hesitate to look at
Hoping that this will help
Peace ;)

Thank you brother

You sir are so kind to share this knowledge, I was having trouble with this, i was passing to CURLOPT_POSTFIELDS an array but I didnt realized it required a string... thank you again sir.

Still working nicely in 2021 - One minor recommendation, add 'curl_close($ch);' before the final echo for best practices.

Superb, this helped me with another API service too. Thanks so much!

Thanks a lot!

How do I add the scope?

$scopes = array( 'user-read-playback-state', 'user-read-playback-position' );

where to add

hi! This has worked for me several years, but now it suddenly gives the following error: Error: Forbidden
Your client does not have permission to get URL /api/token from this server. Anyone else facing the same issue? Any ideas what has been changed and how to fix this?

Thanks!

Still worked for me!