Spotify Web API Guide: Authentication, Endpoints, and Rate Limits

For developers looking to integrate music and podcast data into their applications, the Spotify Web API is the ultimate resource. This Spotify Web API guide covers the essential steps to get started: creating an app, handling OAuth 2.0 authentication, and retrieving metadata for artists, tracks, and podcast episodes. Whether you are building a music analysis tool or an automated “long to short” content generator, mastering this API is the first step.

This Spotify Web API guide focuses on the technical implementation of fetching data. If you are looking for a complete solution to automate content creation from podcasts and videos, check out Repostit.io for a streamlined automation solution.

Spotify Web API Guide: Prerequisites

Before diving into the code, this Spotify Web API guide assumes you have the following:

• A Spotify account (free or premium).
• cURL installed on your machine for making API calls. You can install it via your package manager or from the official website.

Spotify Web API Guide: Setting Up Your Account

The first step in this Spotify Web API guide is to set up your developer account. Log in to the Spotify Developer Dashboard. If this is your first time, you may need to read and accept the latest Developer Terms of Service to complete your account setup.

Spotify Web API Guide: Creating an App

An app in the Spotify Developer Dashboard provides the Client ID and Client Secret needed to request an access token. To create an app, follow these steps:

1. Go to your Dashboard.
2. Click on the Create an app button.
3. Enter an App Name (e.g., “My App”) and an App Description (e.g., “This is my first Spotify app”).
4. For the Redirect URI, you can use http://127.0.0.1:3000 for now. This parameter is not needed for the Client Credentials flow covered in this guide.
5. Check the Developer Terms of Service checkbox and click Create.

Once your application is registered, you will be redirected to the app overview page. Here you can find your Client ID directly. To reveal your Client Secret, click on the “View client secret” link. Always store your client secret securely and never expose it publicly. If you suspect it has been compromised, regenerate it immediately by clicking the ROTATE button.

Spotify Web API Guide: OAuth 2.0 Authentication

All requests to the Web API require authorization using OAuth 2.0. As explained in this Spotify Web API guide, the type of token you need depends on your use case. Spotify implements three main authorization flows:

Flow	Access User Resources	Requires Secret Key	Token Refresh
Authorization Code	Yes	Yes (Server-Side)	Yes
Authorization Code with PKCE	Yes	No	Yes
Client Credentials	No	Yes	No

For long-running server applications where the client secret can be safely stored, the Authorization Code flow is recommended. For mobile or desktop apps where storing a secret is not safe, use Authorization Code with PKCE. For backend services like CLIs or daemons that don’t need user-specific data, the Client Credentials flow is the best choice.

Spotify Web API Guide: Requesting an Access Token

The access token is a string containing the credentials and permissions to access a given resource (e.g., artists, albums, or tracks). This Spotify Web API guide demonstrates the Client Credentials flow, which is ideal for server-to-server communication.

With your Client ID and Client Secret in hand, you can request an access token by sending a POST request to the token endpoint:

curl -X POST "https://accounts.spotify.com/api/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=client_credentials&client_id=your-client-id&client_secret=your-client-secret"

The response will return a JSON object containing your access token, which is valid for 1 hour (3600 seconds):

{
  "access_token": "BQDBKJ5eo5jxbtpWjVOj7ryS84khybFpP_lTqzV7uV-T_m0cTfwvdn5BnBSKPxKgEb11",
  "token_type": "Bearer",
  "expires_in": 3600
}

After the token expires, you must request a new one using the same process.

Spotify Web API Guide: Making Your First API Call

Now that you have an access token, this Spotify Web API guide will walk you through making your first API call to retrieve artist metadata.

Spotify Web API Guide: Finding a Spotify ID

Every resource in Spotify (artists, tracks, albums, playlists) has a unique identifier called a Spotify ID. An easy way to get the Spotify ID of an artist is using the Spotify Desktop App:

1. Search for the artist.
2. Click on the three dots icon from the artist profile.
3. Select Share > Copy link to artist.

The Spotify ID is the value that comes right after open.spotify.com/artist/ in the URL. For example, the ID for Radiohead is 4Z8W4fKeB5YxbusRsdQVPb.

Spotify Web API Guide: Requesting Artist Data

Your API call must include the access token using the Authorization header. Here is the cURL command to get artist data:

curl "https://api.spotify.com/v1/artists/4Z8W4fKeB5YxbusRsdQVPb" \
     -H "Authorization: Bearer BQDBKJ5eo5jxbtpWjVOj7ryS84khybFpP_lTqzV7uV-T_m0cTfwvdn5BnBSKPxKgEb11"

If everything goes well, the API will return a JSON response with detailed artist information:

{
  "external_urls": {
    "spotify": "https://open.spotify.com/artist/4Z8W4fKeB5YxbusRsdQVPb"
  },
  "followers": {
    "href": null,
    "total": 7625607
  },
  "genres": ["alternative rock", "art rock", "melancholia", "oxford indie", "permanent wave", "rock"],
  "id": "4Z8W4fKeB5YxbusRsdQVPb",
  "images": [
    {"height": 640, "url": "https://i.scdn.co/image/ab6761610000e5eba03696716c9ee605006047fd", "width": 640}
  ],
  "name": "Radiohead",
  "popularity": 79,
  "type": "artist",
  "uri": "spotify:artist:4Z8W4fKeB5YxbusRsdQVPb"
}

Congratulations! You have made your first API call to the Spotify Web API.

Spotify Web API Guide: Key Endpoints

The base address for the API is https://api.spotify.com. The Web API is RESTful, meaning data resources are accessed via standard HTTP requests. This Spotify Web API guide highlights the most commonly used endpoints.

Method	Action
GET	Retrieves resources
POST	Creates resources
PUT	Changes and/or replaces resources
DELETE	Deletes resources

Spotify Web API Guide: Tracks and Albums

GET https://api.spotify.com/v1/tracks/{id}
GET https://api.spotify.com/v1/albums/{id}

Spotify Web API Guide: Episodes (Podcasts)

For “long to short” automation, retrieving podcast data is essential. Use the Episodes endpoint to get descriptions, durations, and release dates:

GET https://api.spotify.com/v1/episodes/{id}
GET https://api.spotify.com/v1/shows/{id}/episodes

Spotify Web API Guide: Search Endpoint

If you don’t know the Spotify ID, you can use the Search endpoint to find it programmatically:

GET https://api.spotify.com/v1/search?q=Joe+Rogan&type=show&limit=1

Spotify Web API Guide: Response Status Codes

Understanding HTTP status codes is crucial for debugging. This Spotify Web API guide lists the most important ones:

Status Code	Description
200	OK – The request has succeeded.
201	Created – A new resource has been created.
400	Bad Request – Malformed syntax in the request.
401	Unauthorized – Invalid or expired access token.
403	Forbidden – The server understood the request but refuses to authorize it.
404	Not Found – The requested resource could not be found.
429	Too Many Requests – Rate limiting has been applied.

Spotify Web API Guide: Playlists

Playlists are containers for tracks and episodes. Spotify users have created over 1.5 billion of them. This Spotify Web API guide covers the key concepts for working with playlists programmatically.

Public, Private, and Collaborative Playlists

When creating a playlist via the API, the public attribute is true by default, meaning it will appear on the user’s profile and in search results. Setting it to false makes it private. A playlist can also be collaborative, allowing anyone with the link to add or remove tracks. Note that a playlist cannot be both public and collaborative at the same time.

Version Control with snapshot_id

Every change to a playlist is saved in its version history. Endpoints like Create a Playlist and Get a Playlist return a snapshot_id. This identifier can be used to target a specific version of the playlist when making modifications, and concurrent changes are automatically merged into the latest version.

Spotify Web API Guide: Track Relinking

A unique feature covered in this Spotify Web API guide is Track Relinking. Track availability depends on the user’s country. Spotify often has multiple IDs for the same track due to different licensing agreements in different markets.

When you add the market query parameter to your request (e.g., ?market=US), the API will return an alternative track that is playable in that market. The response will include a linked_from object containing information about the original track.

Important: If you plan to perform further operations on a track (like removing it from a playlist), always use the original track ID found in the linked_from object, not the ID of the relinked track.

Spotify Web API Guide: Rate Limits

Spotify calculates rate limits based on the number of calls your app makes in a rolling 30-second window. If your app exceeds this limit, you will receive a 429 Too Many Requests error. The limit varies depending on whether your app is in development mode or extended quota mode.

This Spotify Web API guide recommends the following strategies for handling rate limits:

• Develop a Backoff-Retry Strategy: When you receive a 429 response, check the Retry-After header and wait the specified number of seconds before retrying.
• Use Batch APIs: Endpoints like Get Several Tracks allow you to fetch multiple items in a single request, reducing your total API calls.
• Use the snapshot_id: Avoid re-downloading entire playlists by storing and comparing the snapshot_id to check if it has changed.
• Apply for Extended Quota Mode: If your app is production-ready, you can request a higher rate limit through the Developer Dashboard.

Spotify Web API Guide: Quota Modes

Your app can be in one of two quota modes: Development Mode or Extended Quota Mode.

Mode	Max Users	Rate Limit
Development Mode	Up to 25 allowlisted users	Lower
Extended Quota Mode	Unlimited users	Higher

As of May 2025, Spotify only accepts quota extension applications from established organizations (not individuals) that meet specific requirements, including a minimum of 250,000 monthly active users.

Spotify Web API Guide: Scopes

Scopes define the permissions your app requests from the user. This Spotify Web API guide lists the most commonly used scopes:

Scope	Description
user-read-email	Access the user’s email address.
playlist-read-private	Read access to user’s private playlists.
playlist-modify-public	Write access to a user’s public playlists.
user-library-read	Read access to the user’s “Liked Songs” library.
user-read-recently-played	Read access to the user’s listening history.
user-read-playback-position	Read the user’s playback position in podcast episodes.
streaming	Control playback (requires Spotify Premium).

Spotify Web API Guide: Python Example

Here is a complete Python script based on this Spotify Web API guide. It authenticates using client credentials and fetches artist data:

import requests
import base64

# === CONFIGURATION ===
CLIENT_ID = "YOUR_CLIENT_ID"
CLIENT_SECRET = "YOUR_CLIENT_SECRET"

# === 1. Request Access Token ===
auth_url = "https://accounts.spotify.com/api/token"
auth_header = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()

headers = {
    "Authorization": f"Basic {auth_header}",
    "Content-Type": "application/x-www-form-urlencoded"
}

data = {"grant_type": "client_credentials"}

response = requests.post(auth_url, headers=headers, data=data)
access_token = response.json()["access_token"]

print("Token obtained successfully!")

# === 2. Fetch Artist Data (Radiohead) ===
artist_id = "4Z8W4fKeB5YxbusRsdQVPb"
artist_url = f"https://api.spotify.com/v1/artists/{artist_id}"

api_headers = {"Authorization": f"Bearer {access_token}"}
artist_response = requests.get(artist_url, headers=api_headers)

if artist_response.status_code == 200:
    artist_data = artist_response.json()
    print(f"Artist: {artist_data['name']}")
    print(f"Followers: {artist_data['followers']['total']}")
    print(f"Genres: {', '.join(artist_data['genres'])}")
else:
    print(f"Error: {artist_response.status_code}")

Spotify Web API Guide: What’s Next?

This Spotify Web API guide covered the fundamentals of authentication and data retrieval. Here are some challenges to extend your knowledge:

• Use the Search Endpoint: Instead of manually copying the Spotify ID, use the /search endpoint to find artists, tracks, or podcasts programmatically.
• Implement User Authorization: Explore the Authorization Code flow to access user-specific data like their playlists and listening history.
• Handle Pagination: Many endpoints return paginated results. Use the offset and limit parameters to retrieve large datasets.

Spotify Web API Guide: Frequently Asked Questions