Refresh without client_secret // device flow and PKCE support

[hansmbakker]

Hi @witnessmenow,
nice library! 👍

I saw that currently the token refresh calls are depending on client_secret:

spotify-api-arduino/src/SpotifyArduino.h

Lines 234 to 235 in f0faeac

	const char *refreshAccessTokensBody =
	R"(grant_type=refresh_token&refresh_token=%s&client_id=%s&client_secret=%s)";

However, there are some flows where the client_secret is not needed - it is not needed when the refresh_token was obtained using the device flow, and I see it is also not needed when the PKCE flow was followed.

Would you be open to have changes in your library where the client_secret is optional so that the refresh_token can be fetched using the client_id only?

[witnessmenow]

Thanks!

Yeah I'd be happy to accept once it's documented, doesn't sound like it will be a major change

[hansmbakker]

What do you mean with documented?

PKCE is documented in the spotify documentation. I wrote down the calls for the device flow as well in the forum post - if needed I can clarify those.

[witnessmenow]

No I just mean in this library, that there isn't much point the feature being available if it's not documented in an example of at least the readme.

…

On Tue 17 Jan 2023, 09:05 Hans Bakker, ***@***.***> wrote: What do you mean with documented? PKCE is documented in the spotify documentation. I wrote down the calls for the device flow as well in the forum post - if needed I can clarify those. — Reply to this email directly, view it on GitHub <#51 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAL5PQUTKNJRMDB6BXBU7WLWSZOFPANCNFSM6AAAAAAT5D7HQU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[hansmbakker]

Aah like that, I understand.