nodejs express + create-react-app oauth2.0 error 401 'Invalid access token' Spotify API

Question

I'm trying to build an app that allows me to call Spotify's API from a create-react-app client through a nodejs express server. I'm trying to use the Authorization Code Flow.

It works getting the authorization code using the following code to generate the URL, completely on client side (if and how using server-side is another question):

getSpotifyCodeUrl() {
  const authEndPoint = 'https://accounts.spotify.com/authorize'
  const clientId = CLIENT_ID;
  const responseType = 'code';
  const redirectUrl = 'http://localhost:3000/';
  // TODO: state for cross-site request forgery protection
  // cont state = '...';
  const scope = 'user-read-private user-read-email';
  return(
    authEndPoint +
    '?response_type=' + responseType +
    '&client_id=' + clientId +
    (scope ? '&scope=' + encodeURIComponent(scope) : '') +
    '&redirect_uri=' + encodeURIComponent(redirectUrl)
  )
}

The user simply clicks a link with the href as generated above.

{!this.state.token ? <a className="btn btn--loginApp-link" href={this.getSpotifyCodeUrl()}>
  Login to Spotify
</a> : ""}

After the user gets redirected back, I use the following function to extract the authorization code from

componentDidMount() {
  this.setState({code: new URLSearchParams(window.location.search).get('code')});
}

With the code I retrieve the access token. Call from client:

getSpotifyAccessToken() {
  fetch('/auth?code=' + this.state.code)
    .then((res) => res.json())
    .then(data => {
      this.setState({token: data.token});
      localStorage.setItem('token', this.state.token);
    });
}

API call on server:

app.get("/auth", (req, res) => {
  let code = req.query.code;
  let authOptions = {
    url: 'https://accounts.spotify.com/api/token',
    form: {
      code: code,
      redirect_uri: 'http://localhost:3000/',
      grant_type: 'authorization_code'
    },
    headers: {
      'Authorization': 'Basic ' + (new Buffer.from(clientId + ':' + clientSecret).toString('base64'))
    },
    json: true
  };

  request.post(authOptions, function(error, response, body){
    if (!error && response.statusCode === 200) {
      token = body.access_token;
      res.json({ token: "Token: " + body.access_token});
    } else { 
      console.log("/auth response body")
      console.log(body) 
    } 
  });
});

Strange thing is I get a token, but can also see the following error in my server terminal:

{ error: 'invalid_grant', error_description: 'Invalid authorization code' }

If I then try to use the token to do a (simple) request from client:\

getSpotifyMe() {
  fetch('/me?token=' + this.state.token)
    .then((res) => res.json())
    .then(data => {
      console.log(data);
    });
}

And corresponding server call:

app.get("/me", (req, res) => {
  let token = req.query.token;
  console.log("Token: " + token);
  let options = {
    url: 'https://api.spotify.com/v1/me',
    headers: { 'Authorization': 'Bearer ' + token },
    json: true
  }

  request.get(options, function(error, response, body) {
    console.log("/me request body");
    console.log(body);
    if (!error && response.statusCode === 200) {
      res.json(body);
    } else {
    } 
  })
})

Which gives me a 401 error:

{ error: { status: 401, message: 'Invalid access token' } }

I've tried some things. Doing the call from client, no success. Refreshing tokens, deleting cookies, authorizations from account, but no success. The strange thing is I can use the token said to be invalid in the Spotify Web Console, doing the exact same call I'm trying to do in the application.

Do you know where I'm causing these errors (invalid_grant and 401) in my application? And how I could solve them?

Sjors Hijgenaar Sjors Hijgenaar · Accepted Answer · 2021-08-12T07:07:58

I ended up following the example on Spotify GitHub more closely.

I changed my create-react-app to simply call the /login server route. Don't use fetch like I tried, you'll end up with a cross-origin error once the server calls the Spotify API from a different origin. For some unapparent reason I can't use href="/login", the server simply doesn't respond, but that's fruit for another SO question.

<a href="http://localhost:3001/login">Login to Spotify</a>

The server index.js is now simply the Authorization Code Flow app.js with my own variables and one minor tweak.

My redirect_uri is http://localhost:3001/callback, I struggled long and tiresome with redirecting back to my client create-react-app at http://localhost:3000, perhaps this is where something goes wrong with the auth code and access token, IDK. You wanna go straight into the server-side callback. Much more intuitive for the user as well: one click and bam, logged in, no messy redirects in between.
In the /callback route on the server, when the access_token and refresh_token have either been successfully retrieved or not, that's when you want to redirect back to your client, http://localhost:3000 for me. With the tokens of course. The example uses URL params, I'm guessing setting a cookie should also work, but have to do some research if that's a security no-go.

The small little tweak I made is to the CORS clause for the app. There's no need for incoming request at the server other than coming from my client, so I added a {origin: 'http://localhost:3000'} there, just in case.

 app.use(express.static(__dirname + '../client/build'))
    .use(cors({origin: 'http://localhost:3000'}))
    .use(cookieParser());

That's it, works like a charm, I can see the response body of the /v1/me call coming in at the server (there's a console log in the example code) and tokens are coming back to the client.

nodejs express + create-react-app oauth2.0 error 401 'Invalid access token' Spotify API

1 Answers