Is there support for PCKE in the Exchange() method?

[andrewcretin]

I've started receiving errors saying 'invalid code_verifier' on the Exchange method. This worked fine before, but now I am unable to get a valid token from the code.

On the client I am not getting a code_verifier or any other params as apart of the callback url.

Any help is appreciated.

Thanks

[oliveroneill]

@andrewcretin Did you have any luck working this out? I'm stuck with the same error

[andrewcretin]

No luck yet. I tried debugging for a while, and couldn't find any updates in Spotify docs so left it until now. Will likely look again this week - surely others are experiencing the same

[FrankMoreno]

I'm working on getting this integrated, will hopefully have something in the next week.

[brianstrauch]

Old issue, but here's a working implementation of PKCE in a project of mine if anyone's interested. I solved the "invalid code_verifier" issue by trimming the trailing = from the base64url'd hash: https://github.com/brianstrauch/spotify-cli/blob/da00b4b776b5423b2f0dcdb9966f9d0ae73f68ae/pkg/auth.go#L25

[elliotwms]

Yes this is possible, there's a working example in examples/pkce however this doesn't demonstrate how to actually generate the verifier or the challenge.

I also got caught by the same invalid_code_verifier issue, which I solved by using RawURLEncoding which doesn't add the = padding. I wrote a pkce package in a recent project which solves this if anyone needs a reference implementation: https://github.com/elliotwms/opml-to-spotify/blob/4fa2b4c472083c3d19337af557d4afb61f6e0e88/pkg/pkce/pkce.go#L44-L49