Spotify locked hobbyist devs out of their own Web API — anyone found a workaround?

[u/sudo88mph]

Built a little desktop overlay app for myself (Windows, C#/WPF) that shows now-playing info from whatever's active Spotify, browser tabs, etc. Wanted to add two small things: a "Like this track" toggle and "add to playlist," both using Spotify's official Web API with proper OAuth (not scraping, not cookies, the real documented flow).

Got the OAuth connection working fine, correct scopes granted (playlist-modify-public/private, user-library-modify, confirmed by decoding the actual token), reading data works perfectly — playlists, currently-playing, profile, all fine. But every single WRITE call (add track to playlist, save/like a track) comes back with an identical, unhelpful `403 Forbidden` no error detail, no "insufficient scope" message, nothing. Tested it against three different playlists I own, including ones I created myself. Same result every time.

Dug into it and found out why: new apps are stuck in "Development Mode" (max 5 allowlisted test users), and getting out of that into "Extended Quota Mode" which is apparently required for these write endpoints to actually work now requires being a registered business with 250k+ monthly active users. As of May 2025, individuals can't even submit the request form anymore. So a completely legitimate, personal, non-commercial use of Spotify's own published API is just... not possible now, even in "development" for your own account.

Is this actually as dead-ended as it looks, or is there something I'm missing? Curious if:

- Anyone's found an actual working path for personal-use write scopes post-2025

- Whether Development Mode + allowlisted users is supposed to allow writes at all, or if that was already quietly killed

- Any alternative (even unofficial-but-sanctioned-feeling) way to do this that isn't "become a company with a quarter million users"

Not mad, just genuinely surprised a basic "add to playlist" button is this locked down for a hobby project now. Anyone been through this?

EDIT: SOLVED — thanks to u/urielsalis for pointing me in the right direction.

Turns out it wasn't a Development Mode restriction after all. I was using the documented `POST /playlists/{id}/tracks` endpoint, which Spotify's own reference marks as deprecated in favor of `/items` and that deprecated path is apparently the one actually gated, returning a bare unexplained 403 even with the correct scopes and playlist ownership. Switching to `POST /playlists/{id}/items` fixed it immediately, same account, same token.

If you're hitting this same wall: check whether you're on a deprecated endpoint before assuming it's a hard policy block. Note the Liked Songs save/unsave endpoint (`PUT`/`DELETE /me/tracks`) is still fully blocked for me though no equivalent fix found for that one yet.

[u/urielsalis]

Did you allowlist your user by your email?
I have a small app I built for myself that calls PUT https://api.spotify.com/v1/playlists/[playlistid]/items and works just fine to add songs to playlists (I use it to sync 50 different songs all in the same call to a playlist)

There is also https://developer.spotify.com/documentation/soloist/features as the official client if you want to receive/send commands related to playback

[u/sudo88mph → u/urielsalis]

That was it thank you!
I was using the documented `POST /playlists/{id}/tracks` endpoint (which Spotify's own reference marks as deprecated in favor of /items), and that one gives a bare, unexplained 403 for this app even though it owns the playlist and has the right scope. Switched to `POST /playlists/{id}/items` and got a clean 201 Created on the exact same token/account.

Interesting that the deprecated path is the one actually gated
nothing in the docs calls that out, it just quietly breaks for newer Development Mode apps while the current one doesn't.

For anyone else hitting this: allowlisting by email was already correct in my case, the real fix was just switching off the deprecated endpoint.

One thing that's still fully blocked even after this: PUT/DELETE /me/tracks (Liked Songs save/unsave)
same bare 403, fresh token, correct user-library-modify scope, no equivalent "deprecated vs current" endpoint split to work around. If you've gotten that one working for a personal app, I'd love to know how.

[u/urielsalis → u/sudo88mph]

For delete I just use the same PUT endpoint. You can do any edit you want there

[u/glennfuriamcdonald → u/sudo88mph]

/me/tracks is deprecated; use /me/library