Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
passport-apple-music
Advanced tools
Readme
PassportJS strategy for generating music user token for Apple Music API.
Use this strategy to obtain tokens for personalized endpoints of Apple Music API, e.g.
https://api.music.apple.com/v1/me/recent/played
Read here about how this strategy works
Install the package via npm / yarn:
npm install --save passport-apple-music
For details on obtaining developer token and integrating Apple Music API with JS, see:
You will need to obtain and generate:
Initialize the strategy as follows:
import { Strategy as AppleMusicStrategy } from 'passport-apple-music';
passport.use(new AppleMusicStrategy({
teamID: "<YOUR_TEAM_ID>",
keyID: "<YOUR_KEY_ID>",
callbackURL: "<CALLBACK_URL>",
privateKeyLocation: "path/to/AuthKey_<YOUR_KEY_ID>.p8"
passReqToCallback: true
}, function(req, accessToken, refreshToken, profile, cb) {
// The JWT dev token used to generate the music user token can be accessed via req.query.id_token_hint
// Use this token in authorization header as
// Authorization: Bearer <DEV_TOKEN>
const devToken = req.query.id_token_hint;
// accessToken is the music user token. Always use this token with the devToken above.
// Music-User-Token: <MUSIC_USER_TOKEN>
const musicUserToken = accessToken;
// There is no refreshToken.
cb(null, ...);
}));
Add the login route:
app.get("/login", passport.authenticate('apple-music'));
Finally, add the callback route and handle the response:
app.post("/auth", function(req, res, next) {
passport.authenticate('apple-music', function(err, user, info) {
if (err) {
if (err == "AuthorizationError") {
res.send("Oops! Looks like you didn't allow the app to proceed. Please sign in again!");
} else if (err == "TokenError") {
res.send("Oops! Couldn't get a valid token for Apple Music!");
}
} else {
res.json(user);
}
})(req, res, next);
});
Example request that uses dev token with music user token:
const response = await fetch('https://api.music.apple.com/v1/me/recent/played', {
headers: {
'Authorization': 'Bearer <DEV_TOKEN>',
'Music-User-Token': '<MUSIC_USER_TOKEN>',
},
...
});
{
/**
* Your Team ID (aka Developer ID).
*
* A 10-letter ID that can be found on your account page at https://developer.apple.com/account/#/membership.
*
* This ID requires Apple Developer Program membership ($100/yr).
*/
teamID: string;
/**
* Your Key ID for MusicKit.
*
* A 10-letter ID that can be found or created at https://developer.apple.com/account/resources/authkeys/list.
*
* The key **MUST** have "MusicKit" among "Enabled Services".
*
* To create Key ID with MusicKit access:
* 1) Create Music IDs Identifier at https://developer.apple.com/account/resources/identifiers
* 2) Register new Key at https://developer.apple.com/account/resources/authkeys/add
* 1. Enable (tick) MusicKit
* 2. Click "Configure" and select the Music ID from step 1)
* 3. Save / Continue
* 3) Confirm MusicKit is among enabled services when you go to https://developer.apple.com/account/resources/authkeys/review/<KeyID>
*/
keyID: string;
/**
* Path to the file with private key that belongs to the keyID.
*
* Private key can be downloaded from https://developer.apple.com/account/resources/authkeys/review/<KeyID>.
*
* Note: Private key can be downloaded only once.
*/
privateKeyLocation: string;
/** App Name shown on auth page */
appName?: string;
/** Url of app icon shown on auth page */
appIcon?: string;
jwtOptions?: SignOptions & {
/**
* Encryption algorithm as mentioned in Apple Music API token generation guide.
*
* DO NOT override this value unless you know what you are doing.
*
* Defaults to 'ES256'.
*
* See https://developer.apple.com/documentation/applemusicapi/getting_keys_and_creating_tokens.
*/
algorithm?: Algorithm;
/**
* JWT expiry.
*
* Maximum expiry for Apple Music API token is "180d".
*
* Expressed in seconds or a string describing a time span [zeit/ms](https://github.com/zeit/ms.js).
*
* Eg: 60, "2 days", "10h", "7d"
*/
expiresIn?: string | number;
};
// OAuth2StrategyOptions options:
callbackURL?: string;
customHeaders?: OutgoingHttpHeaders;
scope?: string | string[];
scopeSeparator?: string;
sessionKey?: string;
store?: StateStore;
state?: any;
skipUserProfile?: any;
pkce?: boolean;
proxy?: any;
}
The authentication flow provides no refresh token. Instead, when the token expires, the user has to log in once again.
By default, the token is valid for 180 days. This is the maximum. If you need to change this value,
override the jwt
options passed to AppleMusicStrategy
.
Token generation is based on https://leemartin.dev/creating-an-apple-music-api-token-e0e5067e4281.
This repository is NOT developed, endorsed by Apple Inc. or even related at all to Apple Inc. This library was implemented solely by the community's hardwork, and based on information that is public on Apple Developer's website. The library merely acts as a helper tool for anyone trying to integrate with Apple Music API.
Feel free to open issues and pull requests!
Repo scaffolded with typescript-library-starter
FAQs
PassportJS strategy for generating music user token for Apple Music API.
The npm package passport-apple-music receives a total of 2 weekly downloads. As such, passport-apple-music popularity was classified as not popular.
We found that passport-apple-music demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.