Registry / http-networking / spotify-web-api-node

spotify-web-api-node

JSON →
library5.0.2jsnpmunverified

This library provides a universal wrapper and client for the Spotify Web API, designed to run seamlessly in both Node.js environments and modern browsers via bundlers like browserify, webpack, or rollup. Currently at stable version 5.0.2, the project maintains an active development status, with updates addressing bugs and adding new features, although major version releases can have extended intervals. Its key differentiators include comprehensive coverage of Spotify's Web API endpoints, offering helper functions for fetching music metadata, managing user profiles and playlists, interacting with the user's music library, personalizing content, browsing categories, controlling playback, and managing user/artist following relationships. The library aims to simplify interaction with the Spotify API's OAuth 2.0 authentication flows and various data retrieval/manipulation operations.

http-networkingcommunication
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

The primary class is a default export. For CommonJS environments, if using transpiled ESM, you might need to access the `.default` property: `const SpotifyWebApi = require('spotify-web-api-node').default;`

import SpotifyWebApi from 'spotify-web-api-node'

This example demonstrates how to initialize the SpotifyWebApi, obtain an access token using the Client Credentials Flow, and then make a simple API call to search for an artist. It also briefly mentions the Authorization Code Flow setup.

import SpotifyWebApi from 'spotify-web-api-node'; const clientId = process.env.SPOTIFY_CLIENT_ID ?? ''; const clientSecret = process.env.SPOTIFY_CLIENT_SECRET ?? ''; const redirectUri = process.env.SPOTIFY_REDIRECT_URI ?? 'http://localhost:8888/callback'; // Required for Authorization Code Flow if (!clientId || !clientSecret) { console.error("Please set SPOTIFY_CLIENT_ID and SPOTIFY_CLIENT_SECRET environment variables."); process.exit(1); } const spotifyApi = new SpotifyWebApi({ clientId: clientId, clientSecret: clientSecret, redirectUri: redirectUri }); // Example: Client Credentials Flow (server-side, no user context) spotifyApi.clientCredentialsGrant() .then(data => { console.log('The access token expires in ' + data.body['expires_in'] + ' seconds.'); console.log('The access token is ' + data.body['access_token']); spotifyApi.setAccessToken(data.body['access_token']); // Example: Search for an artist (requires no user context) return spotifyApi.searchArtists('The Weeknd'); }) .then(data => { console.log('Found artists:', data.body.artists.items[0].name); return spotifyApi.getArtistAlbums(data.body.artists.items[0].id); }) .then(data => { console.log('First album:', data.body.items[0].name); }) .catch(err => { console.error('Something went wrong during client credentials flow or API call!', err); }); // For Authorization Code Flow, you'd typically: // 1. Generate an authorization URL: spotifyApi.createAuthorizeURL(['user-read-private', 'user-read-email'], 'some-state'); // 2. Redirect user to that URL. // 3. Handle the callback on your redirectUri, exchanging the code for tokens: // spotifyApi.authorizationCodeGrant(code).then(...).catch(...);
Debug
Known footguns
breakingVersion 4.0.0 introduced a breaking change by modifying playlist-related functions to drop the `userId` parameter. The authenticated user for these operations is now inferred from the access token set on the API instance, removing the need to explicitly pass the user's ID.
breakingVersion 5.0.0 included significant breaking changes to incorporate new features and streamline the API. The README explicitly advises checking the `CHANGELOG.md` for a detailed list of these modifications.
gotchaAuthentication with the Spotify Web API relies on OAuth 2.0, which involves managing access tokens, refresh tokens, and different authorization flows (e.g., Authorization Code, Client Credentials). Access tokens have a limited lifespan and must be refreshed regularly to maintain active sessions.
securityVersion 4.0.0 included an update to the underlying `superagent` dependency to fix a security warning. Running older versions (prior to v4.0.0) might expose applications to vulnerabilities present in outdated HTTP client libraries.
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
0 hits · last 30 days

No traffic data recorded yet.

Resources