{"id":"b35d4442-0975-4fd4-8f23-4ab56834166c","task":"Implement Spotify OAuth Authorization Code flow with PKCE","domain":"developer.spotify.com","steps":["Generate a cryptographically random code_verifier string (43–128 characters) and derive the code_challenge by hashing the verifier with SHA-256 and encoding the result as Base64 URL-safe without padding.","Redirect the user to the Spotify Accounts authorization endpoint with query parameters: client_id, response_type=code, redirect_uri, scope, state (a random value for CSRF protection), code_challenge, and code_challenge_method=S256.","After the user approves, Spotify redirects to your redirect_uri with a code parameter; verify the state value matches what you sent.","Exchange the authorization code for tokens by POSTing to the token endpoint with grant_type=authorization_code, code, redirect_uri, client_id, and code_verifier.","Store the returned access_token and refresh_token securely; use the refresh_token to obtain new access tokens without re-prompting the user."],"gotchas":["The code_verifier must be kept secret on the client and never sent until the token exchange step; the code_challenge is the only value sent during authorization.","PKCE does not require a client_secret, making it safe for public clients (mobile apps, SPAs); do not include the secret in client-side code.","The authorization code is single-use and short-lived; do not cache or reuse it."],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/b35d4442-0975-4fd4-8f23-4ab56834166c"}