Back to Lyrics

Connect the music services.

This guide is for the site owner. Visitors will use the connection buttons in Lyrics once these developer apps are configured. Never paste private signing keys or secrets into the website.

Spotify

  1. Create an app in the Spotify Developer Dashboard.
  2. Register this exact redirect URI: https://unlocktesla.com/api/music/spotify/callback.
  3. Set the server environment value SPOTIFY_CLIENT_ID to the public Client ID, SITE_URL to this site’s HTTPS origin, and SESSION_SECRET to a securely generated random value of at least 32 characters. A Spotify Client Secret is not needed.
  4. Add your testing accounts in Spotify’s app settings. Development mode has account restrictions; broader access requires Spotify approval.

Spotify reports the song playing on an active device. Lyrics come separately from LRCLIB. Playback controls require Spotify Premium and permitted API access.

Apple Music

  1. Join the Apple Developer Program and enable MusicKit. Create a media identifier and MusicKit signing key.
  2. Use your Team ID, Key ID, and private key to generate an ES256 developer token. Restrict its origin to this site.
  3. Set APPLE_MUSIC_DEVELOPER_TOKEN in the hosted environment. Keep the private key outside the site. Replace the token before it expires.

MusicKit handles the user’s Apple Music authorization. An eligible subscription and supported browser are needed for full songs. This page can follow its own player; it cannot read what is currently playing in the separate Apple Music app. Apple’s public API does not provide lyric text.

YouTube / Google

  1. Create a project in Google Cloud and enable YouTube Data API v3.
  2. Configure the OAuth consent screen and create a Web application OAuth client. Add this site’s HTTPS origin to Authorized JavaScript origins.
  3. Add the read-only YouTube scope https://www.googleapis.com/auth/youtube.readonly. Add test users while the app is in testing.
  4. Set the public OAuth client ID as GOOGLE_CLIENT_ID in the server environment. No Google Client Secret is used by this browser authorization flow. Complete Google verification before a wider launch when required.

Google authorization lets people choose their liked YouTube videos. A pasted video link works without it. Playback uses the official visible YouTube player; this does not read playback from the separate YouTube Music app. Lyric search is independent.

Before inviting users

Set provider credentials through the site’s server environment, then test sign-in, account cancellation, and playback with approved test accounts. Check provider approvals and lyric rights for your intended audience. This site’s private access setting is separate from its music connections.