How to Automate Spotify Audience Segmentation for Your CRM using the API

Understanding the Spotify Web API

Setting Up Spotify API Authentication

Audience segmentation requires each individual Spotify user to authorize your app — there is no batch authorization or server-to-server approach. You need user-read-email to retrieve their email for CRM matching, user-read-private for country/product tier, and user-top-read for listening taste data. Each authorized user gets their own access token and refresh token that you must store securely per user. Access tokens expire in 3,600 seconds.

1. 1Log in to https://developer.spotify.com/dashboard with your Spotify Premium account (required for Development Mode)
2. 2Click 'Create app', add name and description, set redirect URIs to your actual website URL (e.g., https://yourapp.com/auth/spotify/callback)
3. 3Copy Client ID and Client Secret from app settings
4. 4Build the authorization URL with required scopes: GET https://accounts.spotify.com/authorize?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=YOUR_REDIRECT_URI&scope=user-read-email%20user-read-private%20user-top-read
5. 5Embed an 'Connect Spotify' button on your site that redirects users to this authorization URL
6. 6In your callback handler, exchange the code for tokens: POST https://accounts.spotify.com/api/token with grant_type=authorization_code
7. 7Store each user's access_token, refresh_token, and spotify_user_id in your database, linked to their CRM contact record
8. 8Refresh individual user tokens before each sync run using their stored refresh_token
9. 9In Development Mode, manually add test users at developer.spotify.com/dashboard — only added users can authorize (max 5 total)

1import os
2import base64
3import requests
4from datetime import datetime, timedelta
5
6CLIENT_ID = os.environ['SPOTIFY_CLIENT_ID']
7CLIENT_SECRET = os.environ['SPOTIFY_CLIENT_SECRET']
8
9def get_auth_url(redirect_uri, state=None):
10    """Generate the OAuth authorization URL for a user."""
11    scopes = 'user-read-email user-read-private user-top-read'
12    params = {
13        'client_id': CLIENT_ID,
14        'response_type': 'code',
15        'redirect_uri': redirect_uri,
16        'scope': scopes
17    }
18    if state:
19        params['state'] = state  # CSRF protection
20    from urllib.parse import urlencode
21    return f'https://accounts.spotify.com/authorize?{urlencode(params)}'
22
23def exchange_code_for_tokens(code, redirect_uri):
24    """Exchange authorization code for access and refresh tokens."""
25    creds = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()
26    response = requests.post(
27        'https://accounts.spotify.com/api/token',
28        headers={'Authorization': f'Basic {creds}'},
29        data={'grant_type': 'authorization_code', 'code': code, 'redirect_uri': redirect_uri}
30    )
31    response.raise_for_status()
32    data = response.json()
33    return {
34        'access_token': data['access_token'],
35        'refresh_token': data['refresh_token'],
36        'expires_at': (datetime.now() + timedelta(seconds=3600)).isoformat()
37    }
38
39def refresh_user_token(refresh_token):
40    """Refresh a user's access token."""
41    creds = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()
42    response = requests.post(
43        'https://accounts.spotify.com/api/token',
44        headers={'Authorization': f'Basic {creds}'},
45        data={'grant_type': 'refresh_token', 'refresh_token': refresh_token}
46    )
47    response.raise_for_status()
48    return response.json()['access_token']

Key endpoints

1{"id":"wizzler","display_name":"John W","email":"john@example.com","country":"US","product":"premium","followers":{"total":25},"external_urls":{"spotify":"https://open.spotify.com/user/wizzler"}}

1{"items":[{"id":"7jy3rLJdDQY21OgRLCZ9sD","name":"Foo Fighters","genres":["alternative metal","alternative rock","post-grunge","rock"],"popularity":79,"external_urls":{"spotify":"https://open.spotify.com/artist/7jy3rLJdDQY21OgRLCZ9sD"}}],"total":20}

1{"items":[{"id":"4iV5W9uYEdYUVa79Axb7Rh","name":"Everlong","artists":[{"name":"Foo Fighters"}],"popularity":74,"uri":"spotify:track:4iV5W9uYEdYUVa79Axb7Rh"}],"total":50}

1{"items":[{"id":"3cEYpjA9oz9GiPac4AsH4n","name":"Workout Hits","tracks":{"total":45},"public":true}],"total":12}

Step-by-step automation

1# Step 1: Exchange authorization code for tokens
2curl -X POST 'https://accounts.spotify.com/api/token' \
3  -H 'Authorization: Basic BASE64_CLIENT_ID_COLON_SECRET' \
4  -H 'Content-Type: application/x-www-form-urlencoded' \
5  -d 'grant_type=authorization_code&code=AUTH_CODE&redirect_uri=https%3A%2F%2Fyourapp.com%2Fauth%2Fspotify%2Fcallback'
6
7# Step 2: Fetch user profile with email
8curl 'https://api.spotify.com/v1/me' \
9  -H 'Authorization: Bearer ACCESS_TOKEN'

1curl -G 'https://api.spotify.com/v1/me/top/artists' \
2  -H 'Authorization: Bearer USER_ACCESS_TOKEN' \
3  -d 'time_range=short_term' \
4  -d 'limit=20'

1# Example: Update HubSpot contact with Spotify segments
2# Replace YOUR_HUBSPOT_ACCESS_TOKEN and CONTACT_ID
3curl -X PATCH 'https://api.hubapi.com/crm/v3/objects/contacts/CONTACT_ID' \
4  -H 'Authorization: Bearer YOUR_HUBSPOT_ACCESS_TOKEN' \
5  -H 'Content-Type: application/json' \
6  -d '{"properties":{"spotify_top_genre":"alternative rock","spotify_taste_profile":"popular-niche","spotify_avg_popularity":"67","spotify_connected":"true"}}'

1# Refresh a user's token (run per user in the batch job)
2curl -X POST 'https://accounts.spotify.com/api/token' \
3  -H 'Authorization: Basic BASE64_CLIENT_ID_COLON_SECRET' \
4  -H 'Content-Type: application/x-www-form-urlencoded' \
5  -d 'grant_type=refresh_token&refresh_token=USER_REFRESH_TOKEN'

Complete working code

This is a two-part system. The first part handles the OAuth callback when a user connects their Spotify account. The second part runs a monthly batch re-sync of all connected users. Both parts are shown in the complete automation script. Replace the database stubs with your actual database implementation.

1import os
2import base64
3import time
4import requests
5from collections import Counter
6from datetime import datetime
7
8CLIENT_ID = os.environ['SPOTIFY_CLIENT_ID']
9CLIENT_SECRET = os.environ['SPOTIFY_CLIENT_SECRET']
10REDIRECT_URI = os.environ['SPOTIFY_REDIRECT_URI']
11
12def get_creds_header():
13    return base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()
14
15def exchange_code(code):
16    r = requests.post('https://accounts.spotify.com/api/token',
17        headers={'Authorization': f'Basic {get_creds_header()}'},
18        data={'grant_type': 'authorization_code', 'code': code, 'redirect_uri': REDIRECT_URI})
19    r.raise_for_status()
20    return r.json()
21
22def refresh_user_token(refresh_token):
23    r = requests.post('https://accounts.spotify.com/api/token',
24        headers={'Authorization': f'Basic {get_creds_header()}'},
25        data={'grant_type': 'refresh_token', 'refresh_token': refresh_token})
26    r.raise_for_status()
27    return r.json()['access_token']
28
29def api_get(token, path, params=None):
30    r = requests.get(f'https://api.spotify.com/v1{path}',
31        headers={'Authorization': f'Bearer {token}'}, params=params)
32    if r.status_code == 429:
33        time.sleep(int(r.headers.get('Retry-After', 5)))
34        return api_get(token, path, params)
35    r.raise_for_status()
36    return r.json()
37
38def build_segments(access_token):
39    artists = api_get(access_token, '/me/top/artists', {'time_range': 'short_term', 'limit': 20})['items']
40    tracks = api_get(access_token, '/me/top/tracks', {'time_range': 'short_term', 'limit': 20})['items']
41    genre_scores = Counter()
42    for i, a in enumerate(artists):
43        for g in a['genres']:
44            genre_scores[g] += (20 - i)
45    top_genres = [g for g, _ in genre_scores.most_common(5)]
46    avg_pop = sum(t['popularity'] for t in tracks) / len(tracks) if tracks else 0
47    return {
48        'top_genres': top_genres,
49        'top_artists': [a['name'] for a in artists[:5]],
50        'avg_popularity': round(avg_pop),
51        'crm_tags': [f'music_genre:{g.replace(" ","-")}' for g in top_genres[:3]],
52        'synced_at': datetime.now().isoformat()
53    }
54
55# === PART 1: OAuth callback (call from your web route) ===
56def on_spotify_connect(auth_code, crm_contact_id):
57    tokens = exchange_code(auth_code)
58    profile = api_get(tokens['access_token'], '/me')
59    segments = build_segments(tokens['access_token'])
60    # Store in database (implement your own)
61    user_record = {
62        'crm_contact_id': crm_contact_id,
63        'spotify_user_id': profile['id'],
64        'spotify_email': profile.get('email'),
65        'refresh_token': tokens['refresh_token'],
66        'segments': segments
67    }
68    print(f'Connected: {profile.get("email")} -> {segments["top_genres"][:2]}')
69    return user_record
70
71# === PART 2: Monthly batch re-sync ===
72def batch_resync(connected_users):
73    # connected_users: list of {crm_contact_id, refresh_token} from DB
74    success, failed = 0, 0
75    for user in connected_users:
76        try:
77            token = refresh_user_token(user['refresh_token'])
78            segments = build_segments(token)
79            print(f'Re-synced {user["crm_contact_id"]}: {segments["top_genres"][:2]}')
80            success += 1
81            time.sleep(0.5)  # Per-user rate limit courtesy
82        except Exception as e:
83            print(f'Error syncing {user["crm_contact_id"]}: {e}')
84            failed += 1
85    print(f'Batch complete: {success} ok, {failed} failed')

Error handling

Rate Limits for Spotify API

1import time
2
3def api_get_with_retry(token, url, params=None, max_retries=3):
4    headers = {'Authorization': f'Bearer {token}'}
5    for attempt in range(max_retries):
6        r = requests.get(url, headers=headers, params=params)
7        if r.status_code == 429:
8            wait = int(r.headers.get('Retry-After', 2 ** attempt))
9            print(f'Rate limited. Waiting {wait}s (attempt {attempt+1})')
10            time.sleep(wait)
11        elif r.status_code == 401:
12            raise ValueError('Token expired — refresh and retry outside this function')
13        elif r.ok:
14            return r.json()
15        else:
16            r.raise_for_status()
17    raise RuntimeError('Max retries exceeded')

• Process batch re-syncs sequentially with 500ms delays between users — concurrent processing at scale will hit the rolling rate limit
• Run re-syncs during off-peak hours (e.g., 2-4 AM) when your app's other API usage is lower
• Cache the user profile data (email, country) from Step 1 — it rarely changes and does not need re-fetching on every sync
• Honor the Retry-After header on every 429 — do not implement fixed backoff durations
• Log all rate limit events with timestamps to identify patterns in when you're hitting limits

Security checklist

Automation use cases

No-code alternatives

Don't want to write code? These platforms can automate the same workflows visually.

Best practices

• Be upfront with users about what Spotify data you're accessing — display the scope permissions on your Connect Spotify page before they authorize
• Store a spotify_connected_at timestamp and spotify_last_synced timestamp on each CRM contact to track data freshness
• Handle the case where a user's Spotify email differs from their CRM email by matching on spotify_user_id instead of email after initial connection
• Gracefully handle missing email (some Spotify accounts do not have an email address) by falling back to matching on the CRM contact ID passed through the state parameter
• Limit the CRM tags you create to a manageable number — genre tags like 'music_genre:post-grunge' are actionable; storing all 50 raw genres as tags creates noise
• Test your full OAuth flow with a real user account in Development Mode before requesting Extended Quota — many bugs surface during the redirect and callback phase
• Implement a user-facing 'Disconnect Spotify' option that revokes access tokens and clears stored segments — it's legally required under GDPR and builds trust

Ask AI to help

Copy one of these prompts to get a personalized, working implementation.

Related automations

Explore related guides

Guides from other topics that help with this issue