Last.fm authentication flow for the Bash shell

lastfm-oauth.sh

#! /bin/bash

# Lastfm-oauth - v1.0 (build 20160326)
# A Last.fm OAuth helper script for Bash
#
# by Sophie Forceno
#
# Reporting of bugs/issues or general inquiries are encouraged
# If you found this helpful, let me know :-)

# Enter your <username> below
# You must obtain <secret> and <api key> 
# when you register as a developer with last.fm
# Insert them below, they will be hardcoded into the config file
# $lastfm_session_key will be generated by authentication process

# To register as a developer for the Last.FM API:
# https://www.last.fm/api/account/create

if [ ! -f ~/.lastfmrc ]; then
cat > ~/.lastfmrc << EOL
lastfm_user="<username>"
lastfm_api_key="<api key>"
lastfm_secret="<secret>"
lastfm_session_key=""
EOL
fi

source ~/.lastfmrc

### Last.FM Authentication
## Authentication: Step 1
# Method to acquire token that will be combined  
# with lastfm_secret and piped through md5 to obtain api_sig
lastfm_api_url="http://ws.audioscrobbler.com/2.0/"
token_string="?method=auth.gettoken&api_key=$lastfm_api_key&format=json"
token_request=$(curl -s $lastfm_api_url$token_string -H "Accept: application/json" -X GET)
lastfm_token=$(echo $token_request | awk -F: '/token/ { print $2 }' | cut -d '"' -f2)

read -p "Please enter your Last.FM username: " lastfm_user
sed -i "s/lastfm_user=.*/lastfm_user="$lastfm_user"/g" ~/.lastfmrc
echo "You must authorize lastfm-data with Last.fm."
read -p "Press any key to open the authorization URL in your browser"
# If you don't use Google Chrome you can switch the next line to:
# xdg-open "http://www.last.fm/api/auth/?api_key=$lastfm_api_key&token=$lastfm_token" 
# This should open the default browser
google-chrome %U "http://www.last.fm/api/auth/?api_key=$lastfm_api_key&token=$lastfm_token"
read -p "Press any key to continue..."

## Authentication: Step 2
# Construct the API method signature and generate md5 hash
api_sig_1="api_key$lastfm_api_key"
api_sig_2="methodauth.getSessiontoken$lastfm_token$lastfm_secret"
api_sig_cat=$(echo "$api_sig_1$api_sig_2")
md5_api_sig=$(echo -n $api_sig_cat | md5sum | tr -d '-' | sed -e 's/[[:space:]]*$//')

## Authentication: Step 3
# Obtain session_key via md5 hashed API signature, and store it for future requests
session_string="?method=auth.getSession&api_key=$lastfm_api_key&token=$lastfm_token&api_sig=$md5_api_sig"
lastfm_session_key=$(curl -s $lastfm_api_url$session_string -H "Accept: application/xml; charset=UTF-8" -X GET | grep -iPo '(?<=<key>)(.*)(?=</key>)')
sed -i "s/lastfm_session_key=.*/lastfm_session_key="\"$lastfm_session_key\""/g" ~/.lastfmrc

echo -e "\nYou are now authenticated!"

Warning for would be users of this script: this authentication method is wrong! The request in Step 1 also needs a signature, as specified in the last.fm API. If you've tried this method and it didn't work, you're not alone.