I built a Spotify token generator that reverse-engineers the Web Player’s TOTP-based authentication to create anonymous access tokens, complete with automated hourly secret updates via GitHub Actions. I learned how to implement TOTP algorithms from scratch, reverse-engineer obfuscated JavaScript bundles, and build resilient systems with multiple fallback mechanisms.
Web scraping functionality that:
Fetches Spotify's web player homepage
Extracts the web-player JavaScript bundle URL
Parses the bundle to find embedded secrets
Uses regex pattern matching to extract version and secret pairs
Secret transformation functions to convert secrets into different formats (bytes, dictionary)
OTP generation algorithm that:
Transforms secret arrays using XOR operations
Implements Base32 encoding
Uses HMAC-SHA1 for token generation
API endpoint (/api/getToken) that fetches Spotify tokens
Server timestamp fetching from Spotify’s API
Robust fallback system for secret retrieval
Log in to leave a comment
I’m working on my first project! This is so exciting. I can’t wait to share more updates as I build.
Log in to leave a comment