> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsair.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Credentials

> Step-by-step instructions for Spotify OAuth credentials, optional client credentials, and webhook secrets for the Corsair Spotify plugin.

This guide walks you through obtaining all required credentials for the Spotify plugin.

## Authentication Methods

The Spotify plugin supports two authentication methods:

* **[`oauth_2`](/concepts/oauth)** (default) — Authorization Code flow with refresh tokens (recommended for user data and playback)
* **[`api_key`](/concepts/api-key)** — A single stored string used as a **Bearer** access token for the Spotify Web API (advanced: you supply and refresh the token yourself)

The Spotify Web API is OAuth-centric; most users should use [`oauth_2`](/concepts/oauth).

## OAuth 2.0 (Recommended)

### Step 1: Create a Spotify App

1. Open the [Spotify Developer Dashboard](https://developer.spotify.com/dashboard).
2. Log in and click **Create app**.
3. Set the app name, description, and redirect URI placeholder as required.

### Step 2: Configure Redirect URIs

1. Open your app → **Settings**.
2. Under **Redirect URIs**, add the exact callback URL Corsair uses after authorization (must match what you configure in your deployment).
3. Save.

### Step 3: Copy Client ID and Client Secret

1. On the same **Settings** page, copy **Client ID** and **Client Secret**.

**Storing credentials and authorizing:**

```bash theme={null}
pnpm corsair setup --plugin=spotify client_id=your-client-id client_secret=your-client-secret
pnpm corsair auth --plugin=spotify
```

Open the printed URL, sign in with Spotify, and approve — Corsair stores access and refresh tokens.

The integration requests Spotify scopes such as `user-read-private`, `user-read-email`, `user-read-playback-state`, `user-modify-playback-state`, `user-read-currently-playing`, `user-read-recently-played`, `user-library-read`, `user-library-modify`, `user-follow-read`, `user-follow-modify`, `playlist-read-private`, `playlist-read-collaborative`, `playlist-modify-public`, and `playlist-modify-private`. Remove any scopes you do not need when configuring your own OAuth app, if Spotify’s dashboard allows it.

## API Key (Bearer Access Token)

If you set `authType: 'api_key'`, Corsair uses the stored value as the **Bearer** token for API requests. Spotify does not issue long-lived static API keys for the Web API; this mode is for cases where **you** obtain an access token (for example via the Client Credentials flow or a manual token for testing) and store it as `api_key`.

**Storing credentials:**

```bash theme={null}
pnpm corsair setup --plugin=spotify api_key=your-access-token
```

Remember that Spotify access tokens expire; prefer [`oauth_2`](/concepts/oauth) so Corsair can refresh tokens automatically.

## Webhooks (Optional)

If you use Spotify webhooks that sign payloads, store the verification secret Corsair should use for your webhook endpoint.

```bash theme={null}
pnpm corsair setup --plugin=spotify webhook_signature=your-webhook-secret
```

## Required Credentials Summary

| Credential          | Required for                            | Where to find                        |
| ------------------- | --------------------------------------- | ------------------------------------ |
| Client ID / secret  | [`oauth_2`](/concepts/oauth)            | Developer Dashboard → app → Settings |
| Access token string | [`api_key`](/concepts/api-key) (manual) | Your own token acquisition flow      |
| Webhook secret      | Webhooks (if used)                      | Spotify webhook / app configuration  |

For general information about how Corsair handles authentication, see [Authentication](/concepts/auth).