Fix Spotify API February 2026 breaking changes

[peanutlasko]

Fix Spotify API February 2026 Breaking Changes

Context

Spotify's February 2026 API changes introduced several breaking issues for apps in Development Mode:

• tracks field can be null in playlist responses
• GET /users/{id} and GET /users/{id}/playlists endpoints removed
• Playlist link regex only matched digit-only IDs, but Spotify IDs are alphanumeric (e.g. 37i9dQZF1DXcBWIGoYBM5M)
• OAuth flow fails silently with new Development Mode API keys returning 403

Changes

1. Playlist regex fix (spotify.ts parseLink()): Changed \\d+ to .+ to match alphanumeric Spotify IDs.

2. Null tracks handling (spotify.ts _convertPlaylistStructure() and generatePlaylistItem()): Added null checks and optional chaining on tracks?.total / tracks?.href. When tracks is null, falls back to fetching via getPlaylistItems() API directly.

3. OAuth Authorization Code flow (spotify.ts spotifyApiGet()): Direct HTTP bypass for cases where SDK withAccessToken() returns 403 with new Development Mode keys.

4. New API routes:

   • GET /api/spotifyLogin — Initiates OAuth flow, redirects to Spotify authorization page
   • GET /api/spotifyCallback — Handles OAuth callback, exchanges code for tokens
   • POST /api/spotifyLogout — Clears stored OAuth tokens

5. Settings UI (SettingsPage.vue): Added Spotify OAuth connection section showing connection status and login/logout button.

Testing

Tested with Spotify playlists, tracks, and albums using new Development Mode API keys (February 2026). All URL types successfully download after applying these fixes.

Notes

• external_ids removal (ISRC/UPC) was already handled by the existing null check in getTrack() — no change needed there.
• GET /users/{id}/playlists removal affects the sidebar refresh button but does not affect downloading via pasted URL (the primary use case).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 560e8a5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[izldr]

I successfully logged in but now I get this error when trying to download a playlist deemix-webui:dev: [error] Bad OAuth request (wrong consumer key, bad nonce, expired timestamp...). Unfortunately, re-authenticating the user won't help here. Body: {"error": {"status": 403, "message": "Forbidden" } }

[peanutlasko]

@izldr you need to make sure you've created a spotify developer account and setup your key/secret. Then copy/paste the key and secret into Deemix.

https://developer.spotify.com

[izldr]

hey man! thanks for responding so quickly. I actually do have a spotify premium account because I happen to work for starbucks. Does it have to be a seperate developer account too? I created the app with my regular premium one and then added the email under user management, and I have the correct port setup with api/spotifyCallback as well. I'll try making a developer account

[peanutlasko]

you log in with the same account, but you have to run through a couple of steps to register as a developer. Then you make an application and you'll be provided a key/secret. Plug those into Deemix and it should work. (keep in mind you have to be using my fork, as the main Deemix repo is still pending the fix PR).

[izldr]

i have been using your fork and I believe my account is a developer one because you can't access the developer page without being one or create an app. I did put the client id and secret in but it gives me the error that my spotify username isnt valid and that 403 error before. This is despite being connected to spotify through the web portal to the dev server on port 6959. Let me know if there's anything I can test

[peanutlasko]

Make sure you have the RedirectURI in spotify dev portal setup as : https://yourdeemixurl/api/spotifyCallback

I believe Spotify requires https so you'll have to use a reverse proxy or some other way to have https certs.

Also in Deemix, you need to have the username as it appears on spotify profile. So go to spotify.com in the browser, then click the icon in the top right > choose profile > https://open.spotify.com/user/your-user ID-here

After you get those inputted (Dev portal shows correct URI and deemix has correct username), then reboot your Deemix instance and it SHOULD work. Mine has been working well but I was getting the "username not valid" until I rebooted my deemix. I also diconnected/reconnected my spotify using the auth button in Deemix after getting everthing else sorted.

[izldr]

Oh for sure man thanks! I'm not home right now but I will check it out. I did some digging on the rules and I know I have the callback set up correctly. Spotify got rid of localhost and they require https unless you use http://127.0.0.1:6595/api/spotifyCallback

It's probably the username thing that is messing me up. Haven't gotten the correct user id string but I'll check the url.

How did you know what to fix for the api? Just looking at the documentation? Thanks btw

[izldr]

Don't mean to spam or nothing I just really want your fork to work for me. I don't know if my account is just old or something but for some reason my profile shows up as user/username. I don't have any user id that I can find it's just a plain text string. Any tips on how I can find the real user id? I'ma go dig around. thanks bro

[izldr]

So make fun of me for using ai if you want but in this case its nice because it can give reference to the spotify api with sources. I think I just gotta make a new account so I can get another userid

[izldr]

I made a whole new account and added its email to user management but now I just get that huge user id string is "invalid" and

deemix-webui:dev: [error] Bad OAuth request (wrong consumer key, bad nonce, expired timestamp...). Unfortunately, re-authenticating the user won't help here. Body: {"error": {"status": 403, "message": "Forbidden" } }