How to Automate Spotify Playlist Curation using the API

Understanding the Spotify Web API

Setting Up Spotify API Authentication

Spotify uses OAuth 2.0 Authorization Code flow for user-specific operations like playlist creation. You exchange a code for an access token (valid 1 hour) and a refresh token (long-lived). Client Credentials flow only works for public catalog data — it cannot create or modify playlists because those operations require user identity.

1. 1Go to https://developer.spotify.com/dashboard and log in with your Spotify Premium account
2. 2Click 'Create app', fill in the app name, description, and set a redirect URI (e.g. http://localhost:8888/callback)
3. 3Note your Client ID and Client Secret from the app settings page
4. 4Request the authorization URL: GET https://accounts.spotify.com/authorize?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=YOUR_REDIRECT_URI&scope=playlist-modify-public%20playlist-modify-private
5. 5The user is redirected to YOUR_REDIRECT_URI?code=AUTH_CODE — extract the code parameter
6. 6Exchange the code for tokens via POST https://accounts.spotify.com/api/token with grant_type=authorization_code, code, redirect_uri, and Authorization: Basic base64(client_id:client_secret)
7. 7Store the access_token (expires in 3600s) and refresh_token securely in environment variables
8. 8When the access token expires, POST to https://accounts.spotify.com/api/token with grant_type=refresh_token and your refresh_token to get a new one

1import os
2import base64
3import requests
4
5CLIENT_ID = os.environ['SPOTIFY_CLIENT_ID']
6CLIENT_SECRET = os.environ['SPOTIFY_CLIENT_SECRET']
7REFRESH_TOKEN = os.environ['SPOTIFY_REFRESH_TOKEN']
8
9def get_access_token():
10    """Exchange refresh token for a new access token."""
11    credentials = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()
12    response = requests.post(
13        'https://accounts.spotify.com/api/token',
14        headers={'Authorization': f'Basic {credentials}'},
15        data={
16            'grant_type': 'refresh_token',
17            'refresh_token': REFRESH_TOKEN
18        }
19    )
20    response.raise_for_status()
21    return response.json()['access_token']
22
23token = get_access_token()
24headers = {'Authorization': f'Bearer {token}'}

Key endpoints

1{"tracks":{"items":[{"id":"4iV5W9uYEdYUVa79Axb7Rh","name":"Bohemian Rhapsody","artists":[{"name":"Queen"}],"album":{"name":"A Night at the Opera","release_date":"1975-11-21"},"popularity":82,"uri":"spotify:track:4iV5W9uYEdYUVa79Axb7Rh"}],"total":847,"next":"https://api.spotify.com/v1/search?q=bohemian+rhapsody&type=track&offset=20"}}

1{"name":"My Curated Playlist","description":"Auto-generated from rock hits 2023","public":false}

1{"id":"3cEYpjA9oz9GiPac4AsH4n","name":"My Curated Playlist","external_urls":{"spotify":"https://open.spotify.com/playlist/3cEYpjA9oz9GiPac4AsH4n"},"snapshot_id":"MTY2LDljYzE0OTM4MjVkN2UxMjdmNzJiNGI4YjBiZmMxMzIxMzExYjM0ZQ==","tracks":{"total":0}}

1{"uris":["spotify:track:4iV5W9uYEdYUVa79Axb7Rh","spotify:track:0VjIjW4GlUZAMYd2vXMi3b"],"position":0}

1{"snapshot_id":"MTY2LDljYzE0OTM4MjVkN2UxMjdmNzJiNGI4YjBiZmMxMzIxMzExYjM0ZQ=="}

1{"items":[{"id":"3cEYpjA9oz9GiPac4AsH4n","name":"My Curated Playlist","tracks":{"total":12},"snapshot_id":"MTY2..."}],"total":8,"next":null}

Step-by-step automation

1curl -X GET 'https://api.spotify.com/v1/me' \
2  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

1curl -G 'https://api.spotify.com/v1/search' \
2  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
3  --data-urlencode 'q=genre:indie-rock year:2024' \
4  --data-urlencode 'type=track' \
5  -d 'limit=50' \
6  -d 'market=US'

1curl -X POST 'https://api.spotify.com/v1/users/YOUR_USER_ID/playlists' \
2  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
3  -H 'Content-Type: application/json' \
4  -d '{"name":"Weekly Indie Rock Picks","description":"Auto-curated from indie-rock genre, updated weekly","public":false}'

1curl -X POST 'https://api.spotify.com/v1/playlists/PLAYLIST_ID/tracks' \
2  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
3  -H 'Content-Type: application/json' \
4  -d '{"uris":["spotify:track:4iV5W9uYEdYUVa79Axb7Rh","spotify:track:0VjIjW4GlUZAMYd2vXMi3b"]}'

Complete working code

This script runs a complete playlist curation cycle: it gets the user's Spotify ID, searches the catalog for tracks matching a configurable genre and year, creates (or updates) a private playlist, and adds the top tracks in batches. Token refresh is handled automatically. Set SPOTIFY_PLAYLIST_NAME to an existing playlist name to update it instead of creating a new one each run.

1import os
2import base64
3import time
4import requests
5
6CLIENT_ID = os.environ['SPOTIFY_CLIENT_ID']
7CLIENT_SECRET = os.environ['SPOTIFY_CLIENT_SECRET']
8REFRESH_TOKEN = os.environ['SPOTIFY_REFRESH_TOKEN']
9GENRE = os.environ.get('SPOTIFY_GENRE', 'indie-rock')
10YEAR = os.environ.get('SPOTIFY_YEAR', '2024')
11PLAYLIST_NAME = os.environ.get('SPOTIFY_PLAYLIST_NAME', f'Weekly {GENRE.title()} Picks')
12TRACK_COUNT = int(os.environ.get('SPOTIFY_TRACK_COUNT', '20'))
13
14def get_access_token():
15    creds = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()
16    r = requests.post(
17        'https://accounts.spotify.com/api/token',
18        headers={'Authorization': f'Basic {creds}'},
19        data={'grant_type': 'refresh_token', 'refresh_token': REFRESH_TOKEN}
20    )
21    r.raise_for_status()
22    return r.json()['access_token']
23
24def spotify_get(token, path, params=None):
25    r = requests.get(f'https://api.spotify.com/v1{path}',
26        headers={'Authorization': f'Bearer {token}'}, params=params)
27    if r.status_code == 429:
28        wait = int(r.headers.get('Retry-After', 5))
29        print(f'Rate limited, waiting {wait}s...')
30        time.sleep(wait)
31        r = requests.get(f'https://api.spotify.com/v1{path}',
32            headers={'Authorization': f'Bearer {token}'}, params=params)
33    r.raise_for_status()
34    return r.json()
35
36def spotify_post(token, path, payload):
37    r = requests.post(f'https://api.spotify.com/v1{path}',
38        headers={'Authorization': f'Bearer {token}', 'Content-Type': 'application/json'},
39        json=payload)
40    r.raise_for_status()
41    return r.json()
42
43def main():
44    token = get_access_token()
45    user = spotify_get(token, '/me')
46    user_id = user['id']
47    print(f'Authenticated as {user_id}')
48
49    # Search for tracks
50    search_data = spotify_get(token, '/search', {
51        'q': f'genre:{GENRE} year:{YEAR}',
52        'type': 'track', 'limit': 50, 'market': 'US'
53    })
54    tracks = sorted(search_data['tracks']['items'],
55                    key=lambda t: t['popularity'], reverse=True)
56    track_uris = [t['uri'] for t in tracks[:TRACK_COUNT]]
57    print(f'Found {len(track_uris)} tracks to add')
58
59    # Find or create playlist
60    playlists = spotify_get(token, '/me/playlists', {'limit': 50})
61    existing = next((p for p in playlists['items'] if p['name'] == PLAYLIST_NAME), None)
62
63    if existing:
64        playlist_id = existing['id']
65        # Replace all tracks
66        requests.put(f'https://api.spotify.com/v1/playlists/{playlist_id}/tracks',
67            headers={'Authorization': f'Bearer {token}', 'Content-Type': 'application/json'},
68            json={'uris': track_uris[:100]}).raise_for_status()
69        print(f'Updated playlist: {playlist_id}')
70    else:
71        playlist = spotify_post(token, f'/users/{user_id}/playlists', {
72            'name': PLAYLIST_NAME, 'public': False,
73            'description': f'Auto-curated {GENRE} tracks from {YEAR}'
74        })
75        playlist_id = playlist['id']
76        spotify_post(token, f'/playlists/{playlist_id}/tracks', {'uris': track_uris})
77        print(f'Created playlist: {playlist["external_urls"]["spotify"]}')
78
79if __name__ == '__main__':
80    main()

Error handling

Rate Limits for Spotify API

1import time
2
3def spotify_request_with_retry(func, max_retries=5):
4    for attempt in range(max_retries):
5        try:
6            return func()
7        except requests.exceptions.HTTPError as e:
8            if e.response.status_code == 429:
9                retry_after = int(e.response.headers.get('Retry-After', 2 ** attempt))
10                print(f'Rate limited. Waiting {retry_after}s (attempt {attempt+1}/{max_retries})')
11                time.sleep(retry_after)
12            else:
13                raise
14    raise Exception('Max retries exceeded')

• Add 1-second delays between batch operations even when not rate limited — prevents bursts
• Always read and honor the Retry-After header on 429 responses — do not use fixed sleep values
• Cache user IDs, playlist IDs, and token values to minimize unnecessary API calls per run
• In Development Mode, test with a single user and small batches before scaling up
• Log request timestamps to identify patterns if you start seeing unexpected 429s

Security checklist

Automation use cases

No-code alternatives

Don't want to write code? These platforms can automate the same workflows visually.

Best practices

• Always dedup track URIs before adding to a playlist — Spotify allows duplicate tracks and will add them without error
• Use PUT /v1/playlists/{id}/tracks (replace) instead of POST (append) for weekly refreshes to avoid accumulating hundreds of tracks
• Sort search results by popularity descending before selecting tracks — Spotify's search ranking isn't always quality-ordered
• Check response snapshot_id after each add to confirm the operation succeeded before moving to the next batch
• Handle eventual consistency: tracks added via API may take a few seconds to appear on Spotify clients — don't interpret this as an error
• Test in Development Mode with your own account before requesting Extended Quota — the 5-user limit is sufficient for personal automation
• Log the playlist URL from external_urls.spotify after creation — useful for quick manual verification runs

Ask AI to help

Copy one of these prompts to get a personalized, working implementation.

Related automations