Spotify API - error retrieving access token during authorization process

Question

I'm building my first Spotify application and right now I'm tackling the authorization process.

So far I have been successful in retrieving my State and Code from https://accounts.spotify.com/authorize

and now I'm sending a POST request via PHP CURL request to acquire my access token.

Spotify's instructions for this step

I keep getting the following JSON error response indicating that my grant_type is not valid and it offers me three valid options:

{"error":"unsupported_grant_type","error_description":"grant_type must be client_credentials, authorization_code or refresh_token"}bool(true)

If you look at my code below, I believe I have set the correct grant_type of "authorization_code" but I'm getting the error. I have highlighted with '******' the code snippet of what I believe to be the correct line of code.

Can anyone see what I'm doing incorrectly? Here's the code I'm using to send the request:

    //  Get access tokens
        $ch = curl_init();              
        // Specify the HTTP headers to send.
                //Authorization: Basic <base64 encoded client_id:client_secret>
                $ClientIDSpotify = "[my spotify app id]";
                $ClientSecretSpotify = "[my secret code]";
                $authorization = base64_encode ( "{$ClientIDSpotify}:{$ClientSecretSpotify}" );
                $http_headers = array( 
                            "Authorization: Basic {$authorization}"
                        );
                curl_setopt( $ch, CURLOPT_HTTPHEADER, $http_headers );
        curl_setopt( $ch, CURLOPT_POST, true);

        $spotify_url = "https://accounts.spotify.com/api/token";
        curl_setopt( $ch, CURLOPT_URL, $spotify_url );



        // *************************************************
        // HERE'S WHERE I CORRECTLY SPECIFY THE GRANT TYPE
        // *************************************************
        $data['grant_type'] = "authorization_code";
        $data['code'] = $authorizationCode;
        $callbackURL = "[my callback URL]";     
        $data['redirect_uri'] = $callbackURL;    

        curl_setopt($ch, CURLOPT_SAFE_UPLOAD, false);
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
        $response_json = curl_exec( $ch );
        curl_close( $ch );
    }

Answer 1

Just as a note to the last comment about switching to http_build_query, I had to URLDECODE the data, in order for Spotify to recognize it. Try using this line instead.

curl_setopt($ch, CURLOPT_POSTFIELDS, urldecode(http_build_query($data)));

Answer 2

Seems to me like the POST body isn't being formatted correctly, everything else looks good.

My limited understanding of PHP tells me that your POST body looks like

{ "fields" : { "code" : $authorizationCode, "grant_type" : "authorization_code", "redirect_uri" : "http://www.example.com/spotify/callback/index.php" } }

Of course, what you'd like to send is just

{ "code" : $authorizationCode, "grant_type" : "authorization_code", "redirect_uri" : "http://www.example.com/spotify/callback/index.php" }

Therefore, try to set the $data object with

$data['grant_type'] = "authorization_code"; $data['code'] = $authorizationCode; $data['redirect_uri'] = $callbackURL;

or even shorter

$data = array("grant_type" => "authorization_code", "code" => $authorizationCode, "redirect_uri" => $callbackURL);

Hope this helped!

Answer 3

OK, so I dug a little digging and found some code in the PHP CURL manual comments section. The problem with Spotify's documentation is it doesn't specify the format of the POST data to be sent. I assumed since Spotify was sending me JSON data that I should be sending my data in JSON format as well. So I was formatting the POST data as such:

        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));

After reading through some documentation I decided to try this instead:

        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));

I got exactly the results I needed:

        {"access_token":"[long access token]","token_type":"Bearer","expires_in":3600,"refresh_token":"[long refresh token]"}

Thank you, Michael, for attempting to assist!