Automate Spotify and YouTube Playlists - Chapter 2: Setting Up Spotify

In Chapter 1, we talked about what we're building and what accounts you need. If you've got a Spotify account, a Google account, and a GitHub account ready, you're exactly where you need to be.

Today we set up Spotify. By the end of this chapter, you'll have three things: a CLIENT_ID, a CLIENT_SECRET, and a REFRESH_TOKEN. These are the keys that let our script talk to Spotify on your behalf.

Let's go.

Step 1: Create a Spotify Developer App

Open your browser and go to developer.spotify.com. Log in with your regular Spotify account — the same one you use to listen to music.

Once you're in, click on your profile name at the top right, then click Dashboard.

You'll land on a page that says "My Apps" with a button that says Create app. Click it.

A form appears. Fill it in like this:

• App name: Something descriptive. I'll use youtube-to-spotify. You can name yours whatever you like.
• App description: " \"Syncs a YouTube playlist to Spotify.\" One sentence is enough."
• Redirect URI: Type exactly this: http://127.0.0.1:8888/callback

That Redirect URI looks technical, but it's just a local address on your own computer that Spotify will use during the one-time login step we'll do shortly. Copy it exactly as written.

• APIs used: Check the box for Web API.

Accept the terms and click Save.

Your app is created. You'll land on the app's settings page.

Step 2: Copy Your Client ID and Client Secret

On your app's settings page, you'll see two values:

• Client ID — visible immediately, a long string of letters and numbers
• Client Secret — click "View client secret" to reveal it

Copy both of these somewhere safe for now — a notes app, a text file, anywhere. We'll put them in the right place in Chapter 5 when we set up our project.

These two values identify your app to Spotify. The Client ID is like a username. The Client Secret is like a password. Don't share them publicly.

Step 3: Get Your Refresh Token (The One-Time Login)

This is the step that trips most people up, so read carefully. I promise it's not as bad as it looks.

Here's why we need a Refresh Token: when our script runs automatically every day on GitHub, nobody is sitting there to log in to Spotify. The script needs a way to prove it has permission to modify your playlists without you clicking "Login" every time. The Refresh Token is that proof — a long-lived credential you get once, store safely, and the script uses forever.

We get it by doing a one-time login flow. Here's how.

3a. Build the Login URL

Take the URL below and replace YOUR_CLIENT_ID with your actual Client ID:

https://accounts.spotify.com/authorize?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=http://127.0.0.1:8888/callback&scope=playlist-modify-public%20playlist-modify-private

Paste that full URL into your browser and press Enter.

Spotify will ask you to log in (if you aren't already) and then show a permissions screen asking if you want to give your app access to your playlists. Click Agree.

After you click Agree, your browser will try to open a page at http://127.0.0.1:8888/callback — and it will fail with something like "This site can't be reached." That's completely fine and expected. We haven't built a server to catch that request. What we need is already in the browser's address bar.

Look at the URL in your address bar. It will look like this:

http://127.0.0.1:8888/callback?code=AQBvXw3Kv...a_very_long_string_here

Copy everything after ?code=. That long string is your authorization code. Don't close the tab yet.

3b. Exchange the Code for a Refresh Token

Now we'll swap that code for a Refresh Token using a tool called curl. If you're on Windows, open Command Prompt. On Mac or Linux, open Terminal.

Run this command, replacing the three placeholder values with your own:

curl -X POST https://accounts.spotify.com/api/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=YOUR_AUTHORIZATION_CODE" \
  -d "redirect_uri=http://127.0.0.1:8888/callback" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET"

If curl isn't available on your Windows machine, you can use PowerShell instead:

Invoke-RestMethod -Method Post -Uri "https://accounts.spotify.com/api/token" `
  -Headers @{ Authorization = "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("YOUR_CLIENT_ID:YOUR_CLIENT_SECRET")) } `
  -Body @{
    grant_type   = "authorization_code"
    code         = "YOUR_AUTHORIZATION_CODE"
    redirect_uri = "http://127.0.0.1:8888/callback"
  }

Press Enter. You'll get back a block of JSON that looks like this:

{
  "access_token": "BQA...short_lived_token",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "AQA...this_is_the_one_you_want",
  "scope": "playlist-modify-private playlist-modify-public"
}

The value next to "refresh_token" is what we're after. Copy it and keep it safe alongside your Client ID and Client Secret.

The access_token expires in an hour. The refresh_token doesn't expire (unless you revoke it). Our script uses the Refresh Token to generate a fresh access token every time it runs — that's why it works unattended.

Step 4: Note Your Spotify Playlist ID

Remember the playlist you created in Chapter 1? We need its ID.

Open Spotify, right-click on your playlist, and select Share → Copy link to playlist. You'll get a link like:

https://open.spotify.com/playlist/37i9dQZF1DXcBWIGoYBM5M

The part after /playlist/ is your Playlist ID. In the example above, that's 37i9dQZF1DXcBWIGoYBM5M. Copy that too.

What You Have Now

At the end of this chapter, you should have four things written down:

These go into our .env file in Chapter 5. Keep them private.

What's Next?

In Chapter 3, we set up the YouTube side. We'll enable the YouTube Data API, grab an API key, and get the ID of the YouTube playlist we want to mirror.

See you there.