How to Get a Spotify API Key (Client ID and Secret, 2026)

November 9, 2026

Short answer

Spotify has no single API key: you create an app in the Spotify Developer Dashboard and use its Client ID and Client Secret to request an access token that lasts one hour. New apps run in development mode, which allows up to 5 allowlisted users and requires the app owner to have Spotify Premium; extended quota mode is open only to organizations with 250,000 or more monthly active users.

A Spotify API key is really two values, a Client ID and a Client Secret, that your app trades for a short-lived access token. You send that token, not the secret, with every Web API call. This guide follows Spotify's own developer docs as they read today, including the February 2026 rules that changed what new apps can do. Whether any of this costs money is covered in Is the Spotify API free?

What you need

A Spotify account with an active Premium subscription. Spotify says the owner of a development mode app must have Premium for the app to work, and the app stops working if it lapses (quota modes).
A redirect URI, only if users will log in. Client credentials needs none, but the form asks for one, so use a loopback address.

How to get a Spotify API key, step by step

Open the dashboard. Log in at developer.spotify.com and go to Dashboard.
Create an app. Click Create an App. Enter an App name and App description; users see both on the consent screen.
Add a redirect URI. For local testing use http://127.0.0.1:3000. The word localhost is not allowed, and anything that is not loopback must be HTTPS (redirect URI rules).
Accept the terms. Tick the Developer Terms of Service box and save.
Copy your credentials. Open the app, then Settings. The Client ID is shown; click View client secret to see the secret (getting started).
Add users, if any. In Settings, User Management, click Add new user for each person who will log in, up to 5.

If a secret leaks, use Rotate on the app page to issue a new one. The old secret stops working (apps docs).

Spotify client credentials flow: get an access token

curl -X POST "https://accounts.spotify.com/api/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET"

The response is {"access_token": "...", "token_type": "Bearer", "expires_in": 3600}. Use the token for one hour, then request a new one. Client credentials has no refresh token, and it cannot read user data such as playlists you follow.

Make your first Spotify Web API request

curl "https://api.spotify.com/v1/artists/4Z8W4fKeB5YxbusRsdQVPb" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

A Python version that caches the token and respects Retry-After:

import os, time
import requests

CID, SECRET = os.environ["SPOTIFY_CLIENT_ID"], os.environ["SPOTIFY_CLIENT_SECRET"]
_token = {"value": None, "exp": 0}

def token():
    if time.time() < _token["exp"] - 60:
        return _token["value"]
    r = requests.post("https://accounts.spotify.com/api/token", data={
        "grant_type": "client_credentials", "client_id": CID, "client_secret": SECRET,
    }, timeout=30)
    r.raise_for_status()
    body = r.json()
    _token.update(value=body["access_token"], exp=time.time() + body["expires_in"])
    return _token["value"]

def get(path, **params):
    while True:
        r = requests.get(f"https://api.spotify.com/v1{path}",
                         headers={"Authorization": f"Bearer {token()}"},
                         params=params, timeout=30)
        if r.status_code == 429:
            time.sleep(int(r.headers.get("Retry-After", "5")))
            continue
        r.raise_for_status()
        return r.json()

artist = get("/artists/4Z8W4fKeB5YxbusRsdQVPb")
print(artist["name"], artist["external_urls"]["spotify"])

Spotify counts rate limits over a rolling 30-second window and publishes no fixed number (rate limits). The loop above is the backoff Spotify asks for.

Which authorization flow do you need?

Flow	Needs the secret	Reads user data	Refresh token	Best for
Client credentials	Yes	No	No	Backend scripts reading catalog data
Authorization code	Yes	Yes	Yes	Web apps with a server
Authorization code with PKCE	No	Yes	Yes	Mobile, desktop and single-page apps

The implicit grant is marked deprecated in Spotify's authorization docs. To refresh a user token, POST grant_type=refresh_token and the refresh_token to the same token URL, with a Basic auth header for the code flow or client_id for PKCE. Spotify may return a new refresh token; if it does not, keep the old one (refreshing tokens).

Spotify development mode limits

Every new app starts in development mode. Since 11 February 2026 for new apps, and 9 March 2026 for existing ones, the rules are tighter (February 2026 migration guide):

Up to 5 authenticated users per app, each added to the allowlist first. Others can log in but get 403 on calls.
The owner needs active Premium.
Batch endpoints for tracks, albums and artists, new releases, categories and artist top tracks are gone.
Search returns at most 10 results per page, down from 50, with a default of 5.
Some fields are dropped, including artist followers and popularity and track popularity.

Separately, since 27 November 2024 new apps cannot use Recommendations, Related Artists, Audio Features or Audio Analysis (Spotify's November 2024 notice). Spotify's February 2026 post says development mode is not meant to be a foundation for building or scaling a business.

Extended quota mode: who can apply

Extended quota mode lifts the user cap. Since 15 May 2025, only organizations can apply. Spotify lists a legally registered business, a launched service, at least 250,000 monthly active users, availability in key Spotify markets and commercial viability. Approved partners then fill in the Quota extension Request tab in app Settings; review takes up to six weeks.

Common Spotify API errors

Status	Likely cause	Fix
400 `invalid_client`	Wrong Client ID or secret	Copy both again from Settings; rotate if unsure
Invalid redirect URI at login	URI not registered exactly, or uses localhost	Register `http://127.0.0.1:PORT`
401	Token missing or older than an hour	Request a new token
403	User not on the allowlist, owner lacks Premium, or the endpoint is closed to your app	Add the user; check the 2024 and 2026 lists
429	Rate limit, or `QUOTA_EXCEEDED` in development mode	Wait `Retry-After` seconds

Status meanings are from Spotify's API calls page.

If you just need public data

If you want artist, track, album or playlist data and do not want a Premium-backed app, a capped search page or missing fields, ScrapeIO reads public Spotify pages by ID or URL: the Spotify artist API, track API, playlist API and search API, at 1 credit a call. Background on the options is in Spotify Web API and scraper options, and agents can use the Spotify MCP server.

curl "https://scrapeio.com/v1/spotify/artist?id=4Z8W4fKeB5YxbusRsdQVPb" \
  -H "x-api-key: YOUR_KEY"

FAQ

Does Spotify have an API key?

Not as one string. You get a Client ID and Client Secret and exchange them for an access token.

Do I need Spotify Premium to use the API?

For a development mode app, yes: the owner needs active Premium. Listeners you add to the allowlist follow Spotify's normal rules.

How long does a Spotify access token last?

One hour (expires_in 3600). Client credentials tokens are simply requested again; user tokens are renewed with the refresh token.

How many users can a Spotify development mode app have?

Up to 5, and each must be added under User Management before they log in.

Why does my Spotify redirect URI fail?

Spotify rejects localhost. Use http://127.0.0.1 with a port, or an HTTPS URL, and register it exactly as your code sends it.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

100 free credits, no card. Credits never expire.

Get API key