Spotify Web API changes (February 2026)

[reima]

Spotify has announced changes to the Web API for integrations in Developer Mode (February 11 for new integrations, March 9 for all existing integrations): Web API Changes - February 2026

From what I could gather this affects the following functions:

• BaseClient::artist_top_tracks – endpoint removed
• BaseClient::new_releases and BaseClient::new_releases_manual – endpoint removed
• BaseClient::albums – endpoint removed
• BaseClient::artists – endpoint removed
• BaseClient::categories and BaseClient::categories_manual – endpoint removed
• BaseClient::get_several_episodes – endpoint removed
• BaseClient::get_several_shows – endpoint removed
• BaseClient::tracks – endpoint removed
• BaseClient::user_playlists and BaseClient::user_playlists_manual – endpoint removed
• BaseClient::user – endpoint removed
• BaseClient::user_playlists and BaseClient::user_playlists_manual – endpoint removed
• OAuthClient::user_playlist_create – endpoint removed, still available for the current user only via POST /me/playlists
• OAuthClient::current_user_saved_albums_delete – endpoint changed to DELETE /me/library
• OAuthClient::remove_users_saved_shows – endpoint changed to DELETE /me/library
• OAuthClient::current_user_saved_tracks_delete – endpoint changed to DELETE /me/library
• OAuthClient::current_user_saved_albums_add – endpoint changed to PUT /me/library
• OAuthClient::save_shows – endpoint changed to PUT /me/library
• OAuthClient::current_user_saved_tracks_add – endpoint changed to PUT /me/library
• OAuthClient::user_artist_check_follow – endpoint changed to GET /me/library
• OAuthClient::current_user_saved_albums_contains – endpoint changed to GET /me/library
• OAuthClient::check_users_saved_shows – endpoint changed to GET /me/library
• OAuthClient::current_user_saved_tracks_contains – endpoint changed to GET /me/library
• OAuthClient::user_follow_artists – endpoint changed to PUT /me/library
• OAuthClient::user_unfollow_artists – endpoint changed to PUT /me/library
• OAuthClient::user_follow_users – endpoint changed to PUT /me/library
• OAuthClient::user_unfollow_users – endpoint changed to PUT /me/library
• OAuthClient::playlist_follow – endpoint changed to PUT /me/library
• OAuthClient::playlist_unfollow – endpoint changed to PUT /me/library
• OAuthClient::playlist_add_items – endpoint changed to POST /playlists/{id}/items
• OAuthClient::playlist_replace_items – endpoint changed to PUT /playlists/{id}/items
• OAuthClient::playlist_reorder_items – endpoint changed to PUT /playlists/{id}/items
• OAuthClient::playlist_remove_specific_occurrences_of_items – endpoint changed to DELETE /playlists/{id}/tracks
• OAuthClient::playlist_remove_all_occurrences_of_items – endpoint changed to DELETE /playlists/{id}/tracks

The changes also affect the following model types:

• SimplifiedAlbum
  • field album_group removed
  • field available_markets removed
• FullAlbum
  • field available_markets removed
  • field external_ids removed
  • field label removed
  • field popularity removed
• FullArtist
  • field followers removed
  • field popularity removed
• SimplifiedPlaylist
  • field tracks renamed to items
• FullPlaylist
  • field tracks renamed to items
• PlaylistItem
  • field track renamed to item
• SimplifiedShow
  • field available_markets removed
  • field publisher removed
• FullShow
  • field available_markets removed
  • field publisher removed
• FullTrack
  • field available_markets removed
  • field external_ids removed
  • field linked_from removed
  • field popularity removed
• SimplifiedTrack
  • field available_markets removed
  • field linked_from removed
• PublicUser
  • field followers removed
• PrivateUser
  • field country removed
  • field email removed
  • field explicit_content removed
  • field followers removed
  • field product removed

[Manishearth]

I just started trying to build an app here and ran up against this problem :/

[ramsayleung]

Thanks for the summary of all the API change, it's pretty frustrated to keep seeing the breaking change of their endpoints in the last minute, I would start to work on the migration once I wrap up the task at hand. And feel free to raise a CR for this if you want to help and contribute to this project

[Manishearth]

@ramsayleung thanks! I updated the APIs I was using in #551, but didn't want to make larger sweeping changes since I wasn't sure I'd be able to reliably test them

[ramsayleung]

Tracker for Web API Change:

• BaseClient::artist_top_tracks – endpoint removed
• BaseClient::new_releases and BaseClient::new_releases_manual – endpoint removed
• BaseClient::albums – endpoint removed
• BaseClient::artists – endpoint removed
• BaseClient::categories and BaseClient::categories_manual – endpoint removed
• BaseClient::get_several_episodes – endpoint removed
• BaseClient::get_several_shows – endpoint removed
• BaseClient::tracks – endpoint removed
• BaseClient::user_playlists and BaseClient::user_playlists_manual – endpoint removed
• BaseClient::user – endpoint removed
• BaseClient::user_playlists and BaseClient::user_playlists_manual – endpoint removed
• OAuthClient::user_playlist_create – endpoint removed, still available for the current user only via POST /me/playlists
• OAuthClient::current_user_saved_albums_delete – endpoint changed to DELETE /me/library
• OAuthClient::remove_users_saved_shows – endpoint changed to DELETE /me/library
• OAuthClient::current_user_saved_tracks_delete – endpoint changed to DELETE /me/library
• OAuthClient::current_user_saved_albums_add – endpoint changed to PUT /me/library
• OAuthClient::save_shows – endpoint changed to PUT /me/library
• OAuthClient::current_user_saved_tracks_add – endpoint changed to PUT /me/library
• OAuthClient::user_artist_check_follow – endpoint changed to GET /me/library
• OAuthClient::current_user_saved_albums_contains – endpoint changed to GET /me/library
• OAuthClient::check_users_saved_shows – endpoint changed to GET /me/library
• OAuthClient::current_user_saved_tracks_contains – endpoint changed to GET /me/library
• OAuthClient::user_follow_artists – endpoint changed to PUT /me/library
• OAuthClient::user_unfollow_artists – endpoint changed to PUT /me/library
• OAuthClient::user_follow_users – endpoint changed to PUT /me/library
• OAuthClient::user_unfollow_users – endpoint changed to PUT /me/library
• OAuthClient::playlist_follow – endpoint changed to PUT /me/library
• OAuthClient::playlist_unfollow – endpoint changed to PUT /me/library
• OAuthClient::playlist_add_items – endpoint changed to POST /playlists/{id}/items
• OAuthClient::playlist_replace_items – endpoint changed to PUT /playlists/{id}/items
• OAuthClient::playlist_reorder_items – endpoint changed to PUT /playlists/{id}/items
• OAuthClient::playlist_remove_specific_occurrences_of_items – endpoint changed to DELETE /playlists/{id}/tracks DELETE /playlists/{id}/items
• OAuthClient::playlist_remove_all_occurrences_of_items – endpoint changed to DELETE /playlists/{id}/tracks DELETE /playlists/{id}/items

The changes also affect the following model types:

• SimplifiedAlbum
  • field album_group removed
  • field available_markets removed
• FullAlbum
  • field available_markets removed
  • field external_ids removed
  • field label removed
  • field popularity removed
• FullArtist
  • field followers removed
  • field popularity removed
• SimplifiedPlaylist
  • field tracks renamed to items
• FullPlaylist
  • field tracks renamed to items
• PlaylistItem
  • field track renamed to item
• SimplifiedShow
  • field available_markets removed
  • field publisher removed
• FullShow
  • field available_markets removed
  • field publisher removed
• FullTrack
  • field available_markets removed
  • field external_ids removed
  • field linked_from removed
  • field popularity removed
• SimplifiedTrack
  • field available_markets removed
  • field linked_from removed
• PublicUser
  • field followers removed
• PrivateUser
  • field country removed
  • field email removed
  • field explicit_content removed
  • field followers removed
  • field product removed

[MaxReb0]

@ramsayleung I can take a look at writing a PR that removes some of these values. We shouldn't just deprecate them because the breaking change has already been introduced right? So just PRs to remove these variables would be necessary

[reima]

Spotify has pushed yet another last second update to the Web API changes: https://developer.spotify.com/documentation/web-api/references/changes/march-2026

The external_ids for albums and tracks have been reintroduced.

[MaxReb0]

These last minute changes are getting ridiculous haha

[ramsayleung]

As Spotify has rolled out their change on the API server, a lot of tests are failing right now, I have to fix these failed test first.

[ramsayleung]

Spotify's February 2026 update explicitly stated that they are "moving away from the Client Credentials flow for metadata endpoints" and restricting "Developer Mode" apps, and Development Mode use will require a Spotify Premium account.

This is what I got when calling their API by client credentials token:

> curl 'https://api.spotify.com/v1/artists/0TnOYISbd1XYRBk9myaseg/albums' \
>   --compressed \
>   -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0' \
>   -H 'Accept: */*' \
>   -H 'Accept-Language: en-US,zh-CN;q=0.9,en;q=0.8' \
>   -H 'Accept-Encoding: gzip, deflate, br, zstd' \
>   -H 'Referer: https://developer.spotify.com/' \
>   -H 'Authorization: Bearer BQC-OiGcD....2ldnS3xl0JzE' \
>   -H 'Origin: https://developer.spotify.com' \
>   -H 'DNT: 1' \
>   -H 'Connection: keep-alive' \
>   -H 'Sec-Fetch-Dest: empty' \
>   -H 'Sec-Fetch-Mode: cors' \
>   -H 'Sec-Fetch-Site: same-site' \
>   -H 'Sec-GPC: 1' \
>   -H 'Priority: u=0' \
>   -H 'Pragma: no-cache' \
>   -H 'Cache-Control: no-cache' \
>   -H 'TE: trailers'
Active premium subscription required for the owner of the app. When the subscription status changes, it can take a few hours before requests are allowed again.%

So I have to disabled almost all the tests in test_with_credential, as I don't have an active premium subscription to run these tests.

It's so hilarious and frustrated to see this change, Spotify need the library developer to subscribe to their premium account, so the library developer would be able to develop, test and maintain their library, the ridiculous thing is, the co-maintainer of this library already requested for subscription support 6 years ago to develop premium-only endpoint, they politely refused and suggested us to write local test for their Web endpoints.

According to the Spotify Announcement

Starting Wednesday, 11 February, all newly created Development Mode Client IDs will be created under the updated Development Mode rules and will have the following restrictions applied by default:

• Development Mode use will require a Spotify Premium account

I have an application created a decade ago for maintaining this library, now I am unable to test OAuth as well, because it's blocked for:

> curl -i -X PUT "https://api.spotify.com/v1/me/library?uris=spotify%3Aalbum%3A4aawyAB9vmqN3uQ7FjRGTy%2Cspotify%3Aalbum%3A628oezqK2qfmCjC6eXNors" \
      -H "Authorization: Bearer $RSPOTIFY_ACCESS_TOKEN" \
      -H "Content-Type: application/json" \
      -d "{}"


HTTP/2 403
cache-control: private, max-age=0
access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 90
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Accept-Encoding
date: Sun, 15 Mar 2026 02:54:07 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google

Check settings on https://developer.spotify.com/dashboard, the user may not be registered.%

Your application is blocked from accessing the Web API since you do not have a Spotify Premium subscription. Upgrade to Spotify Premium to access the Web API and unlock additional features for your app.

I no longer see a viable path for active development under these conditions. After this patch for the current breaking changes, RSpotify will officially enter maintenance mode. I will provide critical security fixes, but new feature development and active testing are no longer sustainable.

---

Updated on March 16th, 2026:

I received a bunch of emails and kind words from the community about RSpotify, also suggesting I enable GitHub Sponsors so they could subscribe to help me continue developing this library.

It's not just about the premium account, but the project has reached a point where I need to focus on other priorities for a while. It's a decision driven by multiple factors, but a significant one is Spotify's increasingly hostile treatment of their own API — they've introduced numerous silent breaking changes where the actual API behavior contradicts their own documentation. There are several concrete examples of this:

• #488: playlist_items() returns unavailable tracks despite the market filter, and available_markets is always empty
• #492: Broken response types from Spotify endpoints
• spotify-player#494: Another instance of undocumented API behavior

I've even reported these issues directly to Spotify's support, but they haven't shown meaningful effort to address them. Maintaining a library on top of an unreliable and chaotic API is deeply frustrating.

This Spotify Web API change is another example of how they communicate with developers. They announced the changes on February 6, 2026; starting Wednesday, February 11, all newly created APIs would fall under the new development rules, and from March 9, these same requirements would also apply to all existing integrations. They keep making these last-minute updates with no time for developers to be aware of and apply the changes.

That's a big part of why I'm stepping back as well.

It's worth noting that maintenance mode means I won't be actively developing new features, but I'll still address critical bugs and accept PRs.

I sincerely appreciate all the support and kind words from the community, but for now, I'm stepping back a bit.