spotipy auth workflow results in error=state_mismatch in browser

Question

I am attempting to run through the Spotify authentication workflow via spotipy and it's prompt_for_user_token utility. I am following the directions here, the official Spotify web API tutorial, verbatim from what I can tell. And using the examples from Paul Lamere's Spotipy project here

I have a premium Spotify account and a registered application with a client id and client secret (both 32 character strings) and the redirect URI given in the example (...//localhost:8888/callback). all shown on my application page (...//developer.spotify.com/my-applications)

Start my application server from app.js the "authentication_code" example in the tutorial (which has been modified to contain my app's client id, client secret, and redirect URI).

$node app.js 
Listening on 8888

after exporting my app's CLIENT_ID, CLIENT_SECRET, and REDIRECT_URI into my environment as described in the tutorial, I run the user_playlists.py example script from Paul Lamere's spotipy examples with my username (really user "id" - 9 digit number) as it's only command line argument.

The browser (chrome) has opened previously with the option to log in to Spotify via Facebook or password. I choose Facebook and I then get a browser alert that reads:

localhost:8888 says:
There was an error during the authentication.

With the browser url at:

...localhost:8888/#error=state_mismatch

And the prompt_for_user_token function never returns. Every time I run the example script now the browser opens, but to a blank page, with the same browser alert and URL.

Is it obvious to anyone what I'm doing wrong or how to find out what the nature or any details of the authentication error are or how to resolve the state_mismatch error or even what it means?

Answer 1

I found a great and basic example of spotify oauth workflow via spotipy which doesn't depend on node or util.prompt_for_user_token here contributed by perelin.

In addition the spotipy documentation does not indicate which of several user level scopes is required for any given spotipy method which would be helpful. But moreover it's a good idea to understand scopes before you start writing client code for spotify. For example: "playlist-read-private" is required for user_playlists as opposed to, "user-library-read", which isn't made clear in the spotipy documentation so you need to look at the official spotify web api documentation and be aware of which scope your spotipy method will (probably) require.