CloudSound

CloudSound is an experimental, open-source SoundCloud client for macOS. It provides a native SwiftUI feed, library, search, track pages, comments, queue, media-key support, and Now Playing integration.

This project is unofficial and is not affiliated with, endorsed by, or supported by SoundCloud. It signs in through SoundCloud's website and uses undocumented private web APIs. Those APIs can change without notice, which can break features or the entire app. Review SoundCloud's terms and use the project at your own risk.

Source-only project

CloudSound is distributed as source code. There are no official binary downloads, signing/notarization service, or built-in updater. Clone the repository, inspect it, and build it locally with your own Apple development identity if desired. This avoids asking users to bypass Gatekeeper for an unsigned download and avoids distributing a brittle private-API client as a signed product.

Repository

• app/ contains the native macOS app.
• website/ contains the Astro marketing site.

Requirements

• macOS 15 or later
• Xcode with Swift 6 support
• XcodeGen
• Node.js 22.12 or later and npm 9.6.5 or later for the website

Build and test the app

cd app
xcodegen generate
xcodebuild -project CloudSound.xcodeproj -scheme CloudSound -destination 'platform=macOS' build
xcodebuild -project CloudSound.xcodeproj -scheme CloudSound -destination 'platform=macOS' test

You can also open app/CloudSound.xcodeproj in Xcode and select your own development team before running or archiving the app.

Run the website

cd website
npm ci
npm run dev

Use npm run build for a production build.

Privacy and security model

• Sign-in happens inside a WKWebView served by trusted HTTPS SoundCloud origins. The app does not receive the password field.
• The captured OAuth token is stored in the macOS Keychain. The current web client ID is stored in UserDefaults, and SoundCloud cookies remain in WebKit's website data store until sign-out clears them.
• Playback restoration is stored locally without track authorization tokens, secret tokens, or signed media descriptors.
• The app has no analytics, advertising SDK, crash reporter, or custom telemetry service.
• The website self-hosts its fonts and does not intentionally load third-party analytics.

Please read SECURITY.md before reporting a vulnerability. Contributions are welcome under CONTRIBUTING.md. The code is available under the MIT License.