There’s the official way of requesting an API token, and then there’s this method.
There’s two endpoint in which you can access Spotify’s resources. There’s the typical HTML generating one (open.spotify.com) and a REST API (api.spotify.com).
When you first visit the HTML endpoint, Spotify assigns you an access token in the form a cookie string, like so
This access token, can actually be used to access resources at the API endpoint, like so
The scope of the token is limited, in my experience, to public content like public playlists, search, artists, browse and tracks endpoints. You cannot use the token to enumerate, say a user’s playlist. In order to do that, you need an authenticated token, which you need to login to get. But what if you’re like me, who doesn’t want to go through the trouble of setting up the whole stupid OAuth flow and just wants things to work, you can make use of the wp_sso_token from the HTML endpoint emitted when you first login.
Using this SSO token, one can use it to request for new privileged access tokens.
The SSO token, as can be seen is valid for a year. So when the access token expires after 3600 seconds, just use the SSO token to renew and you’re good to go. In my case, to renew the access token I also need to include a sp_dc token which is also emitted when you first login. The validity of the sp_dc token, thankfully, is also set to expire in a year and is interchangeable with other SSO token, meaning the two are not tied together.
With this privileged access token, you can then use it to do things like, enumerate a user’s playlist, and then use that to grab the playlist’s contents. Great for scraper.
