OAuth app readiness guide · Music and media

Getting your Spotify app ready for real users

Generated by the research agent, not yet reviewed by a personChecked 2026-10-28spotify.com

Verdict. You can create a Spotify app in minutes, but it only works for 5 allowlisted users and the app owner needs Spotify Premium. Real customers need extended quota mode, which Spotify only grants to registered organizations with about 250,000 monthly active users, and review can take up to 6 weeks. Treat Spotify as a pilot-only integration for most agent products, and read the Developer Policy first because it bans AI training and several common agent features.

At a glance

The answer in one screen

Ease of creation

Quick, with a Premium catch

Dashboard form takes minutes, but the owner account must have an active Premium subscription.

Ease of approval

Partner approval at Spotify's discretion

Extended quota needs a Partner Application from an organization, then an app review. Spotify promises no processing time.

Your hands-on time

15 to 30 min to create; 2 to 4 hours for the extension

Estimate. Extension is a company-email form plus a 4-step questionnaire in the dashboard. Hands-on time is not published.

Waiting on the provider

Up to 6 weeks (app review)

Docs say the app review can take up to six weeks. The Partner Application step has no published timeline.

Do you need your own app yet?

You must bring your own Spotify app.

Composio's Spotify guide says managed OAuth is not currently available. Create a custom auth config with your client ID and secret.

Watch out: decisions you can't undo

Development mode is capped at 5 users and needs the owner on Premium. Create the app under a company-owned Premium account that will stay paid. Do not create it on a personal account of someone who may leave.
Extended quota only accepts organizations. Decide before you build whether your company can meet these. If not, plan Spotify as a personal-use or pilot connection only.
One Client ID per product. Create one dedicated Spotify app for your Composio integration. Do not reuse its client ID in other products or spread users over several apps.
Dev mode quota is now shared across all your apps. Do not create extra apps to get more headroom. They share the same quota buckets.
Extended quota is tied to the reviewed use case. Write the use case and scope list in the questionnaire to cover the agent features you plan for the next 6 to 12 months.

Agent an agent can do it You needs you Waiting on the provider

Prerequisites

What to have ready

To create and connect

A Spotify account with an active Premium subscription (the owner; required for development mode apps to function)
Developer Dashboard access at developer.spotify.com with that account
App name, description, and the redirect URI from your Composio auth config
Agreement to the Spotify Developer Terms and Developer Policy

For approval (can take days)

A legally registered business or organization and a company email address
An active, launched service with at least 250k monthly active users, available in key Spotify markets
Commercial viability and adherence to terms, as listed in the requirements
Partner Application form (Google form) approved before the dashboard Quota extension Request tab is useful
Completed 4-step questionnaire in the dashboard describing your app
A privacy policy that describes how you access, use and share Spotify user data
Working app for the review team to test, plus a way for users to disconnect Spotify

App types

Which one is right for an agent product?

Development mode app

Default for every new app in the Developer Dashboard.

Who can install: Up to 5 allowlisted Spotify users; app owner needs Premium
Review: None
Use it for: Building, testing, and personal or single-account use

Recommended for agents

Extended quota mode app

After a Partner Application is approved and the app passes the app review team.

Who can install: Any number of Spotify users; the allowlist no longer applies
Review: Partner Application, then app review (up to 6 weeks)
Use it for: Agent products with real customers

Client credentials (no user)

OAuth flow with client ID and secret, no user login.

Who can install: Not user-specific
Review: Same app and quota modes
Use it for: Catalog lookups only. It cannot reach user data, so it does not fit a connect-your-account agent.

Spotify has one app type, two quota modesThere is no public versus internal switch. The same Client ID moves from development mode to extended quota mode. For Composio use the authorization code flow with your client secret. Composio stores and refreshes tokens. Official docs

Extended quota is hard to get for small teamsSpotify says development mode is not a base for building or scaling a business (TechCrunch quote of Spotify's February 2026 post). Developers in the community report rejections for apps under the user threshold. Secondary source

Creation steps

Who does what, and how long it takes

YouCheck Premium and company eligibility
10 min
Confirm the owner account has Premium and decide whether your company meets the 250k MAU criteria. If not, accept the 5-user cap.
YouSign in to the Developer Dashboard
2 min
Use the Premium account at developer.spotify.com/dashboard and accept the Developer Terms.
AgentCreate the app and fill the form
5 min
Name, description, redirect URI from Composio. One app per product. Form field names were not checked in this pass.
YouCopy client ID and secret into Composio
3 min
Create a custom auth config in Composio with these. No creation API found.
AgentChoose minimal scopes in the auth config
5 min
Start from the minimal sets above.
YouAllowlist your testers
5 min
Settings, Users Management, Add new user. Enter name and Spotify email, up to 5 users.
YouSubmit the Partner Application
1 to 2 hours
Company email, Google form. Only if you meet the requirements.
WaitingWait for Partner Application decision
Not published
No timeline is published. Spotify promises no processing time.
AgentDraft the quota extension questionnaire
30 min
Settings, Quota extension Request tab. Agent drafts use case, scopes and privacy answers. Developer reviews.
WaitingWait for app review
Up to 6 weeks
Review team tests your app and emails the result. Docs say up to six weeks.

Scopes

What each permission costs you

Spotify lists about 17 user scopes in 8 groups. Scopes are not rated individually by Spotify. Development mode allows any user scope for allowlisted users. In extended quota mode, your reviewed use case and the scope list you submit are what count. Adding scopes later needs a scope extension request.

Agent use case	Scopes	What it costs you
Read profile and plan type	`user-read-privateuser-read-email`	Email and subscription type. Ask only if you need them. Consent screen shows them to every user.
Read playlists	`playlist-read-privateplaylist-read-collaborative`	Reads the user's private and collaborative playlists. Since February 2026, listing items is only for playlists the user owns or collaborates on.
Create and edit playlists	`playlist-modify-publicplaylist-modify-private`	Writes to the user's account. Expect the reviewer to test it.
Read library and saved items	`user-library-read`	Personal listening data.
Save or remove library items, follow or unfollow	`user-library-modifyuser-follow-modify`	Write or delete access. Composio's guide says to add library scopes before reconnecting.
Read what is playing, devices, queue	`user-read-playback-stateuser-read-currently-playing`	Reads live player state and device list.
Control playback	`user-modify-playback-state`	Play, pause, skip, volume, queue. Playback control needs Premium for the end user. Policy bans voice assistants that control Spotify.
Listening history and taste	`user-top-readuser-read-recently-playeduser-read-playback-positionuser-follow-read`	Personal listening data. Policy bans profiling users or analyzing Spotify content.
Web Playback SDK, iOS and Android SDK control	`streamingapp-remote-control`	SDK scopes, not for server-side agents. Streaming only for Premium users.
Upload playlist cover image	`ugc-image-upload`	Write access to user-provided images. Upload endpoint has its own custom rate limit.
Open Access partner programs	`user-soa-linkuser-soa-unlinksoa-manage-entitlementssoa-manage-partnersoa-create-partner`	Part of a separate Open Access API for partners. Not for agent products.

Minimal set: "Build me a playlist" agentplaylist-modify-privateplaylist-read-private

Drop playlist-modify-public unless users want public playlists.

Minimal set: "What am I listening to" agentuser-read-currently-playinguser-read-playback-state

Read-only. Add user-modify-playback-state only if the agent must control playback.

Minimal set: Library helperuser-library-readuser-library-modify

Composio's guide names these two as the ones to add for library tools.

Changing scopes later

Dev mode: edit scopes in your Composio auth config, then have each user reconnect so the new grants apply.
Extended quota: new scopes need a scope extension request to Spotify.
Existing users keep the old grant until they re-authorize.
Check which scopes a user granted in the scope field of the token response.

Approval and distribution

Review, cost and renewal

When you need it: Required for more than 5 users. Without it, only allowlisted users in development mode can use your app. Cost: No fee stated. Renewal: No renewal period published. Spotify may review apps from time to time and can revoke access if you breach the terms.

Partner Application

Not published

Company email form. Organizations only. Criteria: registered business, launched service, 250k MAU, key markets, commercial viability.

App review

Up to 6 weeks

Review team tests your app against the Developer Policy and emails the result to your account email.

Scope extension

Not published

Needed later for any new scopes after extended quota is granted.

What you submit

Partner Application form from a company email
4-step quota extension questionnaire in the dashboard
Use case for which you need the extension
Working app and privacy policy

Common rejection reasons

Fewer than 250k MAUs (community reports this as a rejection reason)
Individual or hobby developer rather than a registered organization
Service not launched, or not available in key markets
Use case breaks the Developer Policy (for example a voice assistant, a game, or a business-targeted product)

Spotify's policy says it makes no promises on processing times or approval. Community threads from 2026 show small developers being turned away.

Before approval: what works and what's capped

Build and test

Full API for the owner and up to 5 allowlisted users, with any scope.

Limit: 5 users. Dev mode quota is shared per developer account. Search limit max is 10 and default 5. Several endpoints were removed in February 2026, including batch fetches and browse endpoints.

First customers

Only allowlisted users. Users who are not on the list can sometimes log in, but API calls then fail.

Limit: Non-allowlisted users get 403 on API calls. Quota overruns return 429 with reason set to QUOTA_EXCEEDED.

Scale

Extended quota mode: unlimited users, no allowlist, higher rate limit.

Limit: Rate limit is a rolling 30 second window. Exact numbers are not published. Use case locked to what was reviewed.

Existing dev apps were migratedNew dev apps got the 5-user cap on February 11, 2026. Existing dev apps moved to the new restrictions on March 9, 2026. Apps already in extended quota mode were not affected. Official docs

Tell quota from rate limitBoth return 429. Since July 2026 a quota error includes a reason of QUOTA_EXCEEDED. Back off for rate limits. Quota does not clear by waiting 30 seconds. Official docs

Data use and compliance

Rules that shape agent design

No AI or ML training. The Developer Policy bans using the Spotify Platform or Spotify Content to train a machine learning or AI model, or to ingest Spotify Content into one.
No analysis or profiling. Do not analyze Spotify Content or the service to create new metrics, benchmarks, or user profiles, including for ad targeting.
Deletion on disconnect. You may store personal data only as long as needed. Users need an easy way to disconnect, and you must delete their data when they do.
Prohibited app types. No voice assistants that control Spotify, no games or trivia, no apps for businesses such as stores, and no apps that transfer data to another service except a user's own data or playlist metadata.
Attribution and display. Show Spotify branding, link metadata and cover art back to Spotify, and do not offer metadata or cover art as a standalone product.
Premium-only streaming. Streaming music through the platform is only for Premium subscribers.
Stable user ID. The account_id field added in May 2026 is the immutable ID to link accounts. Use it instead of id.

Design impactDo not feed Spotify metadata, playlists or listening history into model training, fine-tuning or embeddings stores. Keep prompts short-lived. Build a disconnect flow that deletes stored Spotify data. Avoid voice control features and business or workplace use cases. Official docs

Common blockers

Symptom, cause, fix

Symptom	Cause	Fix
`403` on API calls; message says the user may not be registered in the developer dashboard	App is in development mode and the user is not on the allowlist	Add the user's name and Spotify email under Settings, Users Management, or move to extended quota mode Official docs
`INVALID_CLIENT: Invalid redirect URI`	The `redirect_uri` sent in the authorize request does not exactly match one saved in the dashboard	Copy the exact redirect URI from the Composio auth config into the dashboard settings Secondary source
`429 Too Many Requests` with `reason` `QUOTA_EXCEEDED`	Development mode quota for the developer account is used up	Reduce calls, remember all your dev apps share one budget, or apply for extended quota Official docs
`400` with `invalid_grant` when refreshing	Refresh token older than 6 months, or the user revoked access	Send the user through authorization again Official docs
Spotify app stops working for everyone	The owner's Premium subscription lapsed	Resubscribe on the owner account. It resumes after that. Official docs
Tool fails on library endpoints	Auth config lacks `user-library-read` or `user-library-modify`	Add the scopes in the Composio auth config and reconnect the account Official docs
Extended quota request rejected or no form option	Organization only, with a 250k MAU minimum	Confirm the criteria first. Smaller teams should stay in development mode. Secondary source

Sources

Where every claim comes from

Claim	Source
Development mode: up to 5 users, allowlist required, owner needs Premium	Official docs
Extended quota: organizations only, 250k MAU, review can take up to six weeks	Official docs
Partner Application processing time	Not verified
February 11 and March 9, 2026 dates for dev mode restrictions	Official docs
Client IDs per developer raised to 25; quota counted per developer account (July 2026)	Official docs
Refresh tokens expire 6 months after authorization; enforced July 20, 2026 for existing apps	Secondary source
Access token lifetime 1 hour	Official docs
No AI training, no profiling, delete data on disconnect, prohibited app types	Official docs
Scope review cost per scope	Not verified
Small developers rejected from extended quota	Secondary source
`INVALID_CLIENT: Invalid redirect URI` cause	Not verified
Rate limit values	Not verified
Dashboard form fields and secret masking	Not verified

All sources

Spotify: Quota modes developer.spotify.com
Spotify: Scopes developer.spotify.com
Spotify: Rate limits developer.spotify.com
Spotify: Refreshing tokens developer.spotify.com
Spotify: Refresh token expiration (blog) developer.spotify.com
Spotify: February 2026 migration guide developer.spotify.com
Spotify: July 2026 changelog developer.spotify.com
Spotify: Web API quota updates (blog) developer.spotify.com
Spotify: Developer Policy developer.spotify.com
Composio: Spotify guide docs.composio.dev
Composio: Spotify toolkit page composio.dev
TechCrunch: Spotify changes developer mode API techcrunch.com
Spotify Community: development mode to extended quota mode community.spotify.com