Development/OAuth2

OAuth2 is a protocol that lets external applications request authentication of the user and authorization to perform actions using the web service on their behalf without getting their password. It is an alternative to HTTP Digest Access Authentication that MusicBrainz currently uses.

Basic steps

Registering an application

All developers need to register their application before getting started. A registered OAuth application is assigned a unique Client I and Client Secret. The OAuth protocol recognizes two types of applications:

1. Confidential - Applications that can keep secrets. Typically web applications, running on a server.
2. Public - Applications that have their code exposed to the public and therefore cannot keep secrets. There are typically installed desktop applications or web applications running in the browser.

Client Secret assigned to Confidential applications should not be shared. This does not apply to Public applications, in which case the assigned Client Secret is not treated as a secret and can be embedded in the application code.

Obtaining access token

...

Using access token

After an application has obtained an access token, it may use the token in the web service to get user details or submit data to MusicBrainz on the user's behalf. There are two types of access tokens:

1. Bearer - Very easy to use, but can be used only over HTTPS.
2. MAC - Requires requests to be signed with a secret, but can be used over both HTTP and HTTPS.

Refreshing access token

Access tokens have a limited life-time. During the authorization process, application receives a refresh token, in addition to the first access token. This refresh token allows applications to obtain new access tokens.

Authorization

Scopes

Authorization requests have a limited scope. You should request only the scopes that your application necessarily needs. The following scopes are available in the MusicBrainz OAuth implementation:

profile

View the user's public profile information (username, age, country, homepage).

email

View the user's email.

tag

View and modify the user's private tags.

rating

View and modify the user's private ratings.

collection

View and modify the user's private collections.

submit_puid

Submit new PUIDs to the database.

submit_isrc

Submit new ISRCs to the database.

submit_barcode

Submit barcodes to the database.

Access token usage

...