spotifywebapipython.spotifywebplayertoken

SPOTIFY_WEBUI_URL_GET_ACCESS_TOKEN = 'https://open.spotify.com/get_access_token'

Url used to get access token.

SPOTIFY_WEBUI_URL_GET_SERVER_TIME = 'https://open.spotify.com/server-time'

Url used to get Spotify server time.

class SpotifyWebPlayerToken:

Represents a Spotify web player token for an account.

SpotifyWebPlayerToken( clientId: str = None, profileId: str = None, tokenProviderId: str = None, tokenStorageDir: str = None, tokenStorageFile: str = None, spotifyWebPlayerCookieSpdc: str = None, spotifyWebPlayerCookieSpkey: str = None)

Initializes a new instance of the class.

Arguments:
  • clientId (str): The unique identifier of the application. A null value will default to Shared.
    Default: Shared
  • profileId (str): Profile identifier used when loading / storing the token to disk.
    A null value will default to Shared.
    Default: Shared
  • tokenProviderId (str): Provider identifier used when storing the token to disk. A null value will default to Shared.
    Default: Shared
  • tokenStorageDir (str): The directory path that will contain the Token Cache file.
    A null value will default to the platform specific storage location:
    Example for Windows OS = C:\ProgramData\SpotifyWebApiPython
  • tokenStorageFile (str): The filename and extension of the Token Cache file.
    Default is tokens.json.
  • spotifyWebPlayerCookieSpdc (str): Spotify Web Player Cookie credentials sp_dc value.
  • spotifyWebPlayerCookieSpkey (str): Spotify Web Player Cookie credentials sp_key value.

If the spotifyWebPlayerCookieSpdc and spotifyWebPlayerCookieSpkey values are specified, then the Token Cache File parameters will be ignored and a token created from the specified values.

Otherwise, the Token Cache File is queried to retrieve the sp_dc and sp_key values.

AccessToken: str

An access token that can be provided to a Spotify Web Player application.

ClientId: str

The unique identifier of the application.

ExpiresAt: int

DateTime (in epoch seconds) that the authorization token will expire.

ExpireDateTimeUtc: datetime.datetime

DateTime (in UTC format) that the authorization token will expire.

ExpiresIn: int

The time period (in seconds) for which the access token is valid.

HeaderKey: str

Returns a string containing the header key to assign the authorization token value to. This will always return 'Authorization'.

HeaderValue: str

Returns the value portion of the authorization header, in the form of 'Bearer {token}'.

Example: `Bearer {token value ...}'

IsExpired: bool

Returns true if the token has expired; otherwise, False if not expired.

ProfileId: str

Profile identifier used when loading / storing the token to disk.

def GetAccessTokenFromCookieCredentials(self) -> None:

Get Spotify Web Player access token from stored Spotify Web Player cookie credentials.

This will create a new session to the "https://open.spotify.com" url, passing it the stored cookie credentials.

def GetTotpObject(self) -> tuple[pyotp.totp.TOTP, int]:

Creates a TOTP (Time-based One Time Password) object that can be used to generate a time-based one time password value for the Spotify get_access_token request.

Returns:

totpObj (TOTP): A TOTP object, which can be used to generate the One Time Password value. serverTimeSeconds (int): Spotify server time value (in utc epoch seconds).

TOTP authentication is a 2-factor verification method that uses the time as a variable.

TOTP codes are valid for a short period (typically 30 or 60 seconds) to enhance security by preventing replay attacks.

Here's how a TOTP algorithm works:

  1. A user wants to log into a TOTP 2FA protected application or website. For the OTP authentication to run, the user and the TOTP server need to initially share a static parameter (a secret key).

  2. When the client logs into the protected website, they have to confirm they possess the secret key. So their TOTP token merges the seed and the current timestep and generates a HASH value by running a predetermined HASH function. This value essentially is the OTP code the user sees on the token.

  3. Since the secret key, the HASH function, and the timestep are the same for both parties, the server makes the same computation as the user's OTP generator.

  4. The user enters the OTP and if it is identical to the server's value, the access is granted. If the results of the calculations aren't identical, the access is, naturally, denied.

def Base32FromBytes(self, inputBytes: bytes, secretSauce: str) -> str:

Converts an array of bytes to a base32 string value.

Arguments:
  • inputBytes (bytearray): Array of bytes to convert to Base32.
  • secretSauce (str): Characters allowed in the generated base32 string value.
Returns:

A generated base32 string value.

def CleanBuffer(self, value: str) -> bytes:

Converts a displayable hex string value to a bytes object.

Arguments:
  • value (str): Input value in displayable hex format (e.g. "0140FF").
Returns:

A bytes object that contains the converted value contents.