Spotify and Rdio API about oauthd

[JMPerez]

I'm trying to implement a provider for Spotify, but I'm a bit stuck trying to make it work. Is there any documentation about writing providers?

[thyb]

You have some docs in the wiki pages: https://github.com/oauth-io/oauthd/wiki/Specs:-Provider's-configuration and https://github.com/oauth-io/oauthd/wiki/Expanded-providers

We tried to implement Spotify some month ago but we've faced some issues as they didn't got any documentation on OAuth.

For the implementation of providers, we follow the wishlist: https://oauth.io/wishlist

[JMPerez]

We are working on a new oAuth2 gateway. My main problem right now is that, in order to get an access token given a code, instead of sending the client_id and client_secret as GET parameters, I need to send an Authorization header whose value is Basic <base64 encoded client_id:client_secret>.

This is a bit like Vimeo's oAuth2.

But I can't see how to accomplish this in the conf.json file.

[thyb]

Ah, it's a great news that Spotify is working to implement OAuth2 !

However, we don't support the Client Credential flow which is a server to server flow (the flow you try to implement in the conf.json looks like this flow). We will support it in the future on our server SDK but it can't be used client side with the current implementation.

At Spotify, do you have implemented the OAuth2 authorization code flow (it's the flow which can be described in the conf.json of OAuth.io)?

Interesting! i'm following the thread thanks guys

[TheVinc]

Hi,
Spotify and Rdio were added to the providers list and integrated into the 1.0.0-alpha-6 release.
Spotify implements OAuth2 and we have enabled the 'me' functionality for it.
Rdio implements OAuth1 and isn't compatible with our 'me' feature for the moment.
Thanks for your feedback.

[JMPerez]

Thanks @TheVinc for the great news!

I have just tried the Spotify one using the "Try auth" button on the dashboard and it doesn't work. I'm taken to https://accounts.spotify.com/authorize?response_type=code&client_id=XXXXXX&client_secret=YYYYY&redirect_uri=https%3A%2F%2Foauth.io%2Fauth&state=kvmJJLZ7b5FeWqViP4czjmF0Cy0&scope=%2Cuser-read-email which fails because the scope contains a space in front.

Also, it would be good to remove the client_secret from the URL, since it doesn't have to be sent in that step.

[TheVinc]

Hi,

Thanks for pointing this out.
We will fix that and propagate the changes on oauth.io today or tomorrow.

[Gerst20051]

👍