Authentication

TIDAL uses OAuth2 for authorization. After authorization (Email or 3rd-Party) the response code is then exchanged with the accessToken (authorization: Bearier xxx in Header). The accessToken is only valid for 7 Days and has to be updated.

TIDAL has also implemented a DeviceFlow for devices with limited input (like TVs or NetworkStreamer) and applications that are not web-based (reCaptcha v3 in the webflow). Here the device requests a 4 digit Authcode and a DeviceCode. The user then links the AuthCode to his account and the DeviceCode can then be exchanged for an accessToken.

DeviceFlow

1. Generate a DeviceCode and UserCode
2. Wait for the user to authenticate via link.tidal.com
3. Exchange the DeviceCode with an access_token and a refresh_token

Authorization across the TIDAL API:
Header:
authorization: Bearer {access_token}

WebFlow

TIDALs Web Flow is reCaptcha v3 secured. Implementing reCaptcha v3 outside the web-browser is nearly impossible.

Legacy Username&Password

1. Login
2. (Optional oAuth2 Migration) Get the user_auth_token (You can used the previously received sessionId for authorization) and exchange it with an access_token and refresh_token (Use a MQA-Enabled client_id to enable MQA)

Authorization across the TIDAL API with sessionId:
Url Parameter:
sessionId={sessionId}

Authorization across the TIDAL API after Migration:
Header:
authorization: Bearer {access_token}