Invalid Client message trying to login

[meaghanranieri-blip]

I was using sortyourmusic with no issue 24 hours ago and now when clicking the login button I'm getting the following message on white screen and am unable to login:

INVALID_CLIENT: Insecure redirect URI

I've cleared cache, cookies, used an incognito page and nothing's working.

[ben-moss]

I have just found the same issue - it looks like the site's certificate has recently expired so the redirect URL is no longer secure

[ciemnozet-eng]

What Should I do to mae it work?

[ben-moss]

What Should I do to mae it work?

It needs to be fixed by the site owner, I think

[trentharms]

@plamere / @flonix8 - any chance you guys can take a look?

[StarshipGnomes]

@plamere No rush, but help us out when you get a chance. My Christmas playlists are in shambles. 😂

[Kraken313]

Still the same problem. I hope the owner fixes it, because I use the site a lot.

[flonix8]

My best guess (from a quick research) is that Spotify doesn't allow insecure redirect URIs anymore. The certificate at http://sortyourmusic.playlistmachinery.com is not expired, it just plainly doesn't exist. I can't say if it ever was HTTPS, as I don't have anything to do with the deployment.

@rblxcode123 I think the appeal of this project is that it's open source. Not everyone wants to enter their Spotify credentials on a third-party site. (I know that the authentication flow is not third-party, but it'd be easy to replace that with an identically looking phishing site)

[bmweis]

What do you think of Sortlee? Any good? Part of what attracted me to this project is the maintainers’ affiliation with Spotify (and a preference to support OSS when and where I can).

I also have an issue with the site not working, so I use Sortlee as an alternative. It's a bit more complex looking, but it basically does the same thing.

[ingemar-hn]

This is probably a very simple fix. Spotify has strengthened there security a bit and since 25 November a callback uri has to be fixed.
In web/config.js
var SPOTIFY_REDIRECT_URI = 'http://localhost:8000/';
to
var SPOTIFY_REDIRECT_URI = 'http://127.0.0.1:8000/';

The corresponding change in my (not public) app API login made the login work again.

[The-Devilman]

Spotify is doing some really bad things to its developer community. I was thinking of creating a fork because this error is easy to fix, but two weeks on, they still won't let people create a new app and they aren't responding on their forum either.
Some old apps have also broken (mine, for example), so even when I change the callback, the app doesn't respond at all.

[S7EAK]

This is probably a very simple fix. Spotify has strengthened there security a bit and since 25 November a callback uri has to be fixed. In web/config.js var SPOTIFY_REDIRECT_URI = 'http://localhost:8000/'; to var SPOTIFY_REDIRECT_URI = 'http://127.0.0.1:8000/';

The corresponding change in my (not public) app API login made the login work again.

Hello! I love this website and use it for all my playlists, how were you able to make a login possible again?

[flonix8]

I was on the way to fixing this issue, but now I may have arrived at a showstopping issue:
This app relies on the the /audio-features endpoint of the Spotify API to get bpm information (see: https://developer.spotify.com/documentation/web-api/reference/get-audio-features). Sadly, I cannot get anything but a 403 out of that endpoint. All other API calls work fine, the issues around registering new OAuth clients mentioned above notwithstanding.

Maybe I'm doing something wrong, so anyone else please have a try for yourself.
In any case, the given API endpoint is marked as deprecated and will therefore not be available for new OAuth clients. So, even if there's a way to fix this, it's only a matter of time until it'll stop working in the main deployment of this app.

Some more information about this:
https://developer.spotify.com/blog/2024-11-27-changes-to-the-web-api
https://community.spotify.com/t5/Spotify-for-Developers/Changes-to-Web-API/td-p/6540414

My best guess is, that Spotify wants to prevent people from building apps like this one that may in some ways be competing with their app. They say it's for security reasons but that cannot be true, as I can't see how just removing the audio-features endpoint would help security. Maybe they're working on a feature like this... but even if they do, I'm sure it'll not offer this level of control.

There are other APIs out there that we could query for the bpm information, but these of course cost money, which is totally fair on their part. If someone finds a reasonable free alternative I could look into implementing that.

To Spotify's credit: To my knowledge no other streaming service has ever provided this level of insight into internal song metadata through their public API.

[ingemar-hn]

I totally agree with you about Spotify claiming the change is for security reasons.
Unfortunately I haven't enough knowledge about how the app development works. I was hoping that the fact that the only change that seems necessary is a config change would make it possible to circumvent updating the whole app, i.e. that the app could continue as an app "with existing extended mode Web API access". But I'm probably wrong here.
Anyway, thank you for trying! Your app has been of great help when I've been looking for music to my spinning classes.

[ingemar-hn]

This is probably a very simple fix. Spotify has strengthened there security a bit and since 25 November a callback uri has to be fixed. In web/config.js var SPOTIFY_REDIRECT_URI = 'http://localhost:8000/'; to var SPOTIFY_REDIRECT_URI = 'http://127.0.0.1:8000/';
The corresponding change in my (not public) app API login made the login work again.

Hello! I love this website and use it for all my playlists, how were you able to make a login possible again?

@S7EAK, I didn't mean that I was able to login with Sort Your Music. I managed to login using my own non-public app (not very useful, hence private) by applying the changes described.