DIYgod/RSSHub · error · ConfigNotFoundError

Spotify private RSS is disabled due to the lack of <a href="

Error message

Spotify private RSS is disabled due to the lack of <a href="https://docs.rsshub.app/deploy/config#route-specific-configurations">relevant config</a>

What it means

Thrown as a ConfigNotFoundError from the getPrivateToken() utility function when config.spotify is missing clientId, clientSecret, OR refreshToken. This function is called by Spotify routes that access user-specific data (e.g. /spotify/top/tracks, /spotify/top/artists) using the refresh-token OAuth flow. The refreshToken is a long-lived credential obtained via the Spotify authorization-code flow. This is a stricter check than getPublicToken (error 517) because it additionally requires the refresh token.

Source

Thrown at lib/routes/spotify/utils.ts:30

    const tokenResponse = await ofetch('https://accounts.spotify.com/api/token', {
        method: 'POST',
        headers: {
            Authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`,
            'Content-Type': 'application/x-www-form-urlencoded',
        },
        body: new URLSearchParams({
            grant_type: 'client_credentials',
        }).toString(),
    });
    return tokenResponse.access_token;
}

// Token used to retrieve user-specific information.
// Note that we don't use PKCE since the client secret shall be safe on the server.
async function getPrivateToken() {
    if (!config.spotify || !config.spotify.clientId || !config.spotify.clientSecret || !config.spotify.refreshToken) {
        throw new ConfigNotFoundError('Spotify private RSS is disabled due to the lack of <a href="https://docs.rsshub.app/deploy/config#route-specific-configurations">relevant config</a>');
    }

    const { clientId, clientSecret, refreshToken } = config.spotify;

    const tokenResponse = await ofetch('https://accounts.spotify.com/api/token', {
        method: 'POST',
        headers: {
            Authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`,
            'Content-Type': 'application/x-www-form-urlencoded',
        },
        body: new URLSearchParams({
            grant_type: 'refresh_token',
            refresh_token: refreshToken,
        }).toString(),
    });
    return tokenResponse.access_token;
}

View on GitHub (pinned to bed535e087)

Solutions

1. Ensure SPOTIFY_CLIENT_ID and SPOTIFY_CLIENT_SECRET are set (same as for public routes).
2. Obtain a SPOTIFY_REFRESH_TOKEN by completing the Spotify authorization-code flow: create an app, set the redirect URI, authorize, and exchange the code for a refresh token.
3. Set SPOTIFY_REFRESH_TOKEN in the RSSHub environment and restart.
4. If the refresh token was revoked, re-authorize the app to obtain a new one.

Example fix

# before
# (SPOTIFY_REFRESH_TOKEN not set)

# after (.env)
SPOTIFY_CLIENT_ID=your-client-id
SPOTIFY_CLIENT_SECRET=your-client-secret
SPOTIFY_REFRESH_TOKEN=AQ...your-refresh-token...

if (!config.spotify?.clientId || !config.spotify?.clientSecret || !config.spotify?.refreshToken) {
    throw new ConfigNotFoundError('Spotify private RSS requires SPOTIFY_CLIENT_ID, SPOTIFY_CLIENT_SECRET, and SPOTIFY_REFRESH_TOKEN.');
}

function hasSpotifyPrivateConfig(cfg: typeof config): cfg is typeof config & { spotify: { clientId: string; clientSecret: string; refreshToken: string } } {
    return (
        !!cfg.spotify &&
        typeof cfg.spotify.clientId === 'string' &&
        typeof cfg.spotify.clientSecret === 'string' &&
        typeof cfg.spotify.refreshToken === 'string' &&
        cfg.spotify.refreshToken.length > 0
    );
}

When it happens

Trigger: Any Spotify private-data route is requested (e.g. /spotify/top/tracks) on an instance where SPOTIFY_CLIENT_ID, SPOTIFY_CLIENT_SECRET, or SPOTIFY_REFRESH_TOKEN is not set. The error fires at token acquisition, before any API call.

Common situations: Self-hosted RSSHub with Spotify public credentials but no refresh token; the refresh token was revoked (e.g. user disconnected the app from their Spotify account); or the operator only set the public credentials and did not complete the user-authorization flow.

Related errors

• Spotify public RSS is disabled due to the lack of <a href="h
• Failed to retrieve refresh token from MangaDex API.
• Failed to retrieve access token from MangaDex API.
• Skeb works RSS is disabled due to the lack of <a href="https
• 什么值得买排行榜 is disabled due to the lack of SMZDM_COOKIE

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/7a35a8571458649e. Report an issue: GitHub.