From cb969133ce4e6894dce0f63895249b8931ae8624 Mon Sep 17 00:00:00 2001 From: Fredrik Johansson Date: Sat, 18 Jul 2026 22:27:21 +0200 Subject: [PATCH] Document all four redirect URIs, not just the two local dev ones MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Spent a real debugging session chasing a "not matching configuration" error assuming it was host mode, when it was actually guest PKCE mode hitting a redirect URI (production, root path) that was simply never registered — the README only documented the two local dev URIs, not that host mode and guest mode each need their own entry per environment (four total), and gave no way to tell which flow's request was actually failing. Added the full four-URI table and a note to check the browser's actual address bar at the point of failure — the error message is identical regardless of which flow's redirect_uri didn't match. --- README.md | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index d8c8379..5253006 100644 --- a/README.md +++ b/README.md @@ -63,14 +63,26 @@ cd server && npm install && npm run dev # :3010 cd client && npm install && npm run dev # :3080 in prod, :5190 locally ``` -Register two redirect URIs in the Spotify dashboard (exact string match, -trailing slash matters): +Register **four** redirect URIs in the Spotify dashboard — one pair per +environment, host mode and guest mode each need their own. Exact string +match, trailing slash included: guest mode is `${window.location.origin}/` +(`client/src/lib/pkce.ts`) — that trailing slash is not optional, ever, +in any environment. -- `http://127.0.0.1:3010/api/spotify/callback` — host mode -- `http://127.0.0.1:5190/` — guest PKCE mode (root, no path) +| Environment | Host mode (`/api/spotify/callback`) | Guest PKCE mode (root, no path) | +|---|---|---| +| Local dev | `http://127.0.0.1:3010/api/spotify/callback` | `http://127.0.0.1:5190/` | +| Production | `https:///api/spotify/callback` | `https:///` | -(`127.0.0.1`, not `localhost` — Spotify's HTTPS-required-for-redirect -policy only exempts the literal loopback IP.) +(`127.0.0.1`, not `localhost`, for local dev — Spotify's +HTTPS-required-for-redirect policy only exempts the literal loopback IP.) + +All four need to actually exist in the dashboard's list — host mode and +guest mode failing to match are indistinguishable from the outside +("redirect_uri: Not matching configuration" either way), so if this +error shows up, check the browser's actual address bar at the point of +failure to see which flow's redirect_uri is actually being sent before +assuming which one is missing. ## Deploying