Spotify plugin: Web API Catalog, Library, playlists, Favourites #88

New issue

Closed

opened 2026-10-16 17:04:01 +02:00 by SBDeveloper · 2 comments

SBDeveloper commented

2026-10-16 17:04:01 +02:00

Owner

Part of #85

New optional plugin plugins/optional/spotify (HTTP-only, network to the Spotify API hosts). Uses the Web API for search, Catalog, Library, playlists and Favourites.

See ADR 0021. Acceptance:

Liked Songs, saved albums, followed artists as Favourites, mirrored both ways
playlists as Linked Playlists (ADR 0004); Spotify-owned ones (e.g. Discover Weekly) read-only
every Track carries its ISRC, and the by-ISRC lookup is implemented (ADR 0003)
check Spotify's current developer-mode limits for new apps first and note findings here

Part of #85 New optional plugin `plugins/optional/spotify` (HTTP-only, `network` to the Spotify API hosts). Uses the Web API for search, Catalog, Library, playlists and Favourites. See ADR 0021. Acceptance: - Liked Songs, saved albums, followed artists as Favourites, mirrored both ways - playlists as Linked Playlists (ADR 0004); Spotify-owned ones (e.g. Discover Weekly) read-only - every Track carries its ISRC, and the by-ISRC lookup is implemented (ADR 0003) - check Spotify's current developer-mode limits for new apps first and note findings here

SBDeveloper added the

needs-triage

label

2026-10-16 17:04:01 +02:00

SBDeveloper referenced this issue

2026-10-16 17:04:13 +02:00

Spotify source plugin #85

SBDeveloper referenced this issue

2026-10-16 17:04:14 +02:00

Spotify source plugin #85

SBDeveloper added

enhancement

ready-for-agent

and removed

needs-triage

labels

2026-10-16 17:04:58 +02:00

SBDeveloper commented

2026-10-16 20:22:02 +02:00

Author

Owner

Developer-mode research (Spotify docs: quota-modes, Feb 2026 changelog, March 2026 changelog, Feb 2026 migration guide; checked 2026-10-16)

Limits for a NEW app (Development Mode):

Max 5 authenticated users, each added to the app allowlist by hand. Max 1 client ID per developer (a third-party source claims 25 since July 2026; unverified, not in Spotify's docs).
The app OWNER must have Spotify Premium; without it the app stops working.
Lower rate limits than Extended Quota; endpoints share quota buckets per developer account, 429 when exceeded.
Extended Quota Mode (unlimited users) is only for registered organisations with a launched service and >=250k MAU, review up to 6 weeks. Individuals cannot apply (since 2025-05-15). So a public, build-time client ID shared by all Medley users is NOT viable under the official rules: each user is expected to register their own app (ADR 0021 already allows a client-ID override; #89/#90 should make bring-your-own-client-ID the default path and document it).

API surface changes that hit this plugin (Feb 2026, applied to new apps 2026-02-11, existing 2026-03-09):

Removed: Get Several Tracks/Albums/Artists (so ISRC cannot be batch-hydrated; album track lists are simplified objects without external_ids, the plugin fills ISRCs with one GET /tracks/{id} per track, capped at 50), Artist Top Tracks (plugin falls back to a search by artist), browse/new-releases, GET /users/{id}[/playlists].
Search: limit max 10 (default 5).
Library: per-type save/follow endpoints replaced by PUT/DELETE /me/library?uris= and GET /me/library/contains. Used by set_favourite and playlist unfollow.
Playlists: /playlists/{id}/tracks -> /playlists/{id}/items; response fields tracks -> items, track -> item. Items are only returned for playlists the user owns/collaborates on; other playlists (incl. Spotify-owned like Discover Weekly) return metadata only, so they list but may have no readable Tracks (403 reported). Plugin reads both old and new shapes.
Track/album external_ids (ISRC) was announced as removed then REVERTED in March 2026: ISRC is still on full track objects. Removed fields: popularity, available_markets, artist followers, user.product (so Premium cannot be detected from the Web API; NotPremium is not reported by this plugin).
Recommendations endpoint stays closed (no Radio, per ADR 0021).

Implemented in branch ticket/88-spotify-webapi: plugin-api PlaylistSummary.read_only, plugins/optional/spotify. Not verified against the live API (needs a token); the playlist DELETE-items body shape (items:[{uri}]) follows the Feb 2026 rename and is the least certain.

Developer-mode research (Spotify docs: quota-modes, Feb 2026 changelog, March 2026 changelog, Feb 2026 migration guide; checked 2026-10-16) Limits for a NEW app (Development Mode): - Max 5 authenticated users, each added to the app allowlist by hand. Max 1 client ID per developer (a third-party source claims 25 since July 2026; unverified, not in Spotify's docs). - The app OWNER must have Spotify Premium; without it the app stops working. - Lower rate limits than Extended Quota; endpoints share quota buckets per developer account, 429 when exceeded. - Extended Quota Mode (unlimited users) is only for registered organisations with a launched service and >=250k MAU, review up to 6 weeks. Individuals cannot apply (since 2025-05-15). So a public, build-time client ID shared by all Medley users is NOT viable under the official rules: each user is expected to register their own app (ADR 0021 already allows a client-ID override; #89/#90 should make bring-your-own-client-ID the default path and document it). API surface changes that hit this plugin (Feb 2026, applied to new apps 2026-02-11, existing 2026-03-09): - Removed: Get Several Tracks/Albums/Artists (so ISRC cannot be batch-hydrated; album track lists are simplified objects without external_ids, the plugin fills ISRCs with one GET /tracks/{id} per track, capped at 50), Artist Top Tracks (plugin falls back to a search by artist), browse/new-releases, GET /users/{id}[/playlists]. - Search: limit max 10 (default 5). - Library: per-type save/follow endpoints replaced by PUT/DELETE /me/library?uris= and GET /me/library/contains. Used by set_favourite and playlist unfollow. - Playlists: /playlists/{id}/tracks -> /playlists/{id}/items; response fields tracks -> items, track -> item. Items are only returned for playlists the user owns/collaborates on; other playlists (incl. Spotify-owned like Discover Weekly) return metadata only, so they list but may have no readable Tracks (403 reported). Plugin reads both old and new shapes. - Track/album external_ids (ISRC) was announced as removed then REVERTED in March 2026: ISRC is still on full track objects. Removed fields: popularity, available_markets, artist followers, user.product (so Premium cannot be detected from the Web API; NotPremium is not reported by this plugin). - Recommendations endpoint stays closed (no Radio, per ADR 0021). Implemented in branch ticket/88-spotify-webapi: plugin-api PlaylistSummary.read_only, plugins/optional/spotify. Not verified against the live API (needs a token); the playlist DELETE-items body shape (items:[{uri}]) follows the Feb 2026 rename and is the least certain.

SBDeveloper referenced this issue

2026-10-16 20:37:25 +02:00

Spotify: build secret, CI, Android, registry release, README risks #90

SBDeveloper commented

2026-10-16 21:17:18 +02:00

Author

Owner