Getting 403 Error When Fetching Audio Features Through Spotify API With Valid Authorization

Other Questions Spotify
1

Having trouble getting track audio features from Spotify API

I’m working with the Spotify Web API to get audio features for tracks, but I keep running into a 403 Forbidden response. This is weird because my authentication seems to be working fine.

What’s working:

  • OAuth login completes successfully
  • I can get a valid access token using auth_manager.get_access_token()
  • My token includes the right permissions (user-library-read and playlist-read-private)

Here’s my current implementation:

import requests

# Retrieve token from cache or get a fresh one
cached_token = spotify_auth.get_cached_token()

if cached_token:
    bearer_token = cached_token['access_token']
else:
    # Request new token via OAuth process
    fresh_token = spotify_auth.get_access_token()
    bearer_token = fresh_token['access_token']

print(f"Bearer token: {bearer_token}")

api_url = "https://api.spotify.com/v1/audio-features"
request_headers = {
    "Authorization": f"Bearer {bearer_token}"
}
query_params = {
    "ids": "4iV5W9uYEdYUVa79Axb7Rh"  # Sample track ID
}

api_response = requests.get(api_url, headers=request_headers, params=query_params)

if api_response.status_code == 200:
    print(api_response.json())
else:
    print(f"Request failed {api_response.status_code}: {api_response.text}")

The error I’m getting:

Bearer token: *****
Request failed 403: {
  "error" : {
    "status" : 403
  }
}

What I’ve already checked:

  • Token scopes are set correctly (user-library-read, playlist-read-private)
  • Track ID is valid and publicly available
  • Token hasn’t expired (using cached version)
  • Other API endpoints work fine (like track search)

Anyone know why I might be getting blocked from accessing audio features specifically? What could cause this 403 error?

2

Check your app settings in the Spotify Developer Dashboard. Had the same 403 error - turns out my app was stuck in development mode, which blocks certain API endpoints like audio features. Even with the right scopes and valid tokens, dev apps can’t access most user data endpoints. You’ll need to request a quota extension or switch to production mode if you qualify. Also double-check your client ID matches exactly between your auth flow and dashboard - I had a typo once that caused the same permission issues. The audio features endpoint is way stricter about app permissions than basic search stuff.

3

Honestly, Spotify API quirks like this are exactly why I ditched manual API calls for music data. The scope requirements keep changing, rate limits are unpredictable, and debugging auth issues eats up way too much dev time.

I switched to automating the entire workflow instead. Set up a flow that handles OAuth, manages token refresh automatically, and includes proper error handling with retries. Plus I can chain it with other services - push audio features to a database or trigger actions based on track characteristics.

Automation means you’re not debugging permission issues at 2am when your app breaks in production. It handles edge cases and keeps running even when Spotify changes their API behavior.

Your 403 is probably the scope issue others mentioned, but automating this whole process will save you from similar headaches down the road.

4

Had this exact problem a few months back - spent hours banging my head against the wall. Your code and token are fine. The issue is you’re missing the user-read-private scope in your auth request. Yeah, user-library-read and playlist-read-private work for playlists and saved tracks, but Spotify puts audio features behind a different permission that needs the basic user profile scope. Added that scope, re-authorized, and boom - no more 403 errors. Don’t forget to clear your token cache so you get a fresh token with the new permissions.

5

try the single track endpoint instead - /v1/audio-features/{id} rather than the bulk one. spotify’s weirdly picky about which endpoints work with different scopes, even tho it shouldn’t matter.