Spotify API: INVALID_APP_ID

Question

I am currently working on an android app which is implementing the Spotify API. I have all of the code connecting my app to spotify using the tutorial and have been working

Answer 1

You need to go to your Spotify developer settings and update the

Android Packages

Providing your full package name i.e. com.company.app and the SHA1 fingerprint of the respective build variant.

You can get the fingerprint by running

./gradlew signingReport

There you can find the results for e.g. debug

Variant: debug
Config: debug
Store: /Users/<your username>/.android/debug.keystore
Alias: AndroidDebugKey
MD5:  00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
SHA1: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
Valid until: Monday, August 29, 2046

Saving the settings on your Spotify app page is enough to flush the system so that you can login from your device.

Answer 2

Spotify requires the debug SHA1 during development. Once you release your app, you need to add the release SHA1 for your app, together with your package name as shown in the AndroidManifest. Add this via Spotify's Dashboard for your app in the "Android Packages" section.

To know the SHA1 for release APKs you first need to create a signed APK from within Android Studio.

Then make sure to add the following to your app's build.gradle:

android {
    //...
    signingConfigs {
        release {
            storeFile file('KEY_STORE_PATH_FOR_YOUR_APK')
            storePassword 'YOUR_PW'
            keyAlias 'YOUR_KEY_ALIAS'
            keyPassword 'YOUR_KEY_PW'
        }
    }
    buildTypes {
        //...
        release {
            signingConfig signingConfigs.release
        }
    }
    //...
}

This will allow you to print the release and debug SHA1's to your Logcat. From within Android Studio open the Gradle terminal and set signingReport as command line arg. Click OK and the value will be printed out.

Why is this needed?

When a user has already installed the Spotify app and is already logged in, there is no need to sign in the user again for your app. This will be done automatically in the background using OAuth which requires the SHA1. If the Spotify app is not installed, no SHA1 is needed and the user is prompted to login in your app instead. However, if the user has the Spotify app installed, there is no way to show the login prompt in your app ... hence, the login will fail if the SHA1 is not available.

Answer 3

The answers above were helpful. However, it was another issue that caught me out.

As part of it's release management process, the play store offers to manage release keys. If you enable this feature the SHA-1 certificate for the app is replaced before it is delivered to users. You need to make sure that the new key is also registered on the spotify developers console.

To view the new key, open the google play store developers dashboard, and then click 'Release management > App signing'. You should be able to view the key here.