refreshAccessToken():" WebapiError: Bad request" (Express)

[sisi-sh]

Hey, I'm having an issue using the API to request new access tokens. When trying to get new acess tokens using api.refreshAccessToken(), I consistently get the error: WebapiError: Bad Request. I've verified that the clientID, clientSecret, and refreshToken are valid.

I should note that my current app doesn't do authentication via this API; it authenticates via JMPerez's passport-spotify method, saves the tokens in a signed JWT, and on requests, the tokens are extracted from the JWT and used to authenticate this calls with this API. This has worked for all other requests where only an accessToken is required.

Is there something I'm missing?

If relevant, here's my code for the refreshAccessToken endpiont:

router.get(
    "/refreshAccessToken",
    // decrypt accessToken and refreshToken from JWT
    passport.authenticate("jwt", { session: false }),
    (req, res, next) => {

        const api = new SpotifyWebApi({
            clientID: process.env.CLIENT_ID,
            clientSecret: process.env.CLIENT_SECRET,
        })

        api.setRefreshToken(req.user.refreshToken)

        console.log("refresh request received, attempting to refresh")

        api.refreshAccessToken() // ERROR: WebapiError: Bad Request
            // if refresh successful,
            // refresh cookie with new access token
            .then((data) => {
                req.user.payload = signJwt({
                    accessToken: data.body["access_token"],
                    refreshToken: req.user.refreshToken,
                })

                console.log(
                    `old: ${req.user.accessToken}; new: ${data.body["access_token"]}`
                )

                next()
            })

            // if refresh failed
            .catch((err) => next(err))
    },
    bindPayloadToCookie
)

[dersimn]

Try with clientId (small D) here:

        const api = new SpotifyWebApi({
            clientID: process.env.CLIENT_ID,
            clientSecret: process.env.CLIENT_SECRET,
        })

[sisi-sh]

Unfortunately that doesn't change anything. Every other endpoint I've used in my app works perfectly fine (ex. fetching songs, playlists, etc) which is confusing. Again, I've verified all relevant tokens are valid yet I'm still getting 400 on this endpoint.

[stormtroopa]

I am getting the same error and I am not using express. Maybe Spotify changed smth? I only see it since a few days...

[thelinmichael]

Hi @stormtroopa! What version of spotify-web-api-node are you on? It'd be very helpful with a code snippet.

[Debdut]

I am having the same problem

spotifyApi.getTrack(id)

I have tested getAlbum and some other methods and they are working fine, with getTrack I get

[Error [WebapiError]: Bad Request]
{
  name: 'WebapiError',
  message: 'Bad Request',
  statusCode: 400
}

v4.0.0

[Debdut]

With v5.0.0 I get the following error

body: { error: { status: 400, message: 'invalid id' } },
  headers: {
    'content-type': 'application/json; charset=utf-8',
    'cache-control': 'private, max-age=0',
    'x-robots-tag': 'noindex, nofollow',
    'access-control-allow-origin': '*',
    'access-control-allow-headers': 'Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context',
    'access-control-allow-methods': 'GET, POST, OPTIONS, PUT, DELETE, PATCH',
    'access-control-allow-credentials': 'true',
    'access-control-max-age': '604800',
    'content-encoding': 'gzip',
    'strict-transport-security': 'max-age=31536000',
    'x-content-type-options': 'nosniff',
    date: 'Tue, 13 Oct 2020 21:39:04 GMT',
    server: 'envoy',
    via: 'HTTP/2 edgeproxy, 1.1 google',
    'alt-svc': 'clear',
    connection: 'close',
    'transfer-encoding': 'chunked'
  },
  statusCode: 400
}

Although this is a valid track id 54n8Cwz4keTpSur0Swm3Mu

[stormtroopa]

Hi @stormtroopa! What version of spotify-web-api-node are you on? It'd be very helpful with a code snippet.

@thelinmichael sry for the delay. I checked my code again and compared it to your instructions. I now see my mistake. I use the clientCredentialsGrant. According to the instructions the token can't be refreshed. I now simply call clientCredentialsGrant again after the expiry_time is over. It seems to work. Would you say this is a proper solution?