@wwdrew/expo-spotify-sdk 0.5.0 → 0.6.0

package/LICENSE

@@ -1,3 +1,21 @@
-{
-  "license": "MIT"
-}
+MIT License
+
+Copyright (c) 2024 Andrew Miller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,154 +1,403 @@
 # expo-spotify-sdk
 
-An Expo Module for the native [iOS](https://github.com/spotify/ios-sdk/) and [Android](https://github.com/spotify/android-sdk/) Spotify SDK
+[![npm version](https://img.shields.io/npm/v/@wwdrew/expo-spotify-sdk)](https://www.npmjs.com/package/@wwdrew/expo-spotify-sdk)
+[![CI](https://img.shields.io/github/actions/workflow/status/wwdrew/expo-spotify-sdk/ci.yml?label=CI)](https://github.com/wwdrew/expo-spotify-sdk/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/github/license/wwdrew/expo-spotify-sdk)](LICENSE)
 
-## Supported Features
+An Expo module that wraps the native [Spotify iOS SDK](https://github.com/spotify/ios-sdk) (v5.0.1) and [Spotify Android SDK](https://github.com/spotify/android-sdk) (v4.0.1) to provide OAuth authentication in Expo and React Native apps.
 
-- Authentication
+**Why this exists:** Spotify ships native SDKs for iOS and Android that enable authentication via the installed Spotify app (no browser redirect, better UX) but there is no maintained Expo module for them. This library fills that gap.
 
-More to come...
+## Platform support
 
-## Installation
+| Feature                                       | iOS | Android      | Web                 |
+| --------------------------------------------- | --- | ------------ | ------------------- |
+| `isAvailable()`                               | ✅  | ✅           | ✅ (always `false`) |
+| `authenticateAsync` — CODE flow (recommended) | ✅  | ✅           | —                   |
+| `authenticateAsync` — TOKEN flow (implicit)   | ✅  | ⚠️ see below | —                   |
+| `refreshSessionAsync`                         | ✅  | ✅           | —                   |
+| Auth via installed Spotify app                | ✅  | ✅           | —                   |
+| Auth via Spotify web fallback                 | ✅  | ✅           | —                   |
+
+## Quick start (Expo)
 
 ```sh
+# 1. Install
 npx expo install @wwdrew/expo-spotify-sdk
+
+# 2. Add the config plugin to app.config.ts / app.json  (see Configuration below)
+# 3. Regenerate native projects
+npx expo prebuild
 ```
 
-## Configuration
+For bare React Native (no Expo CLI), see [Installation in bare React Native](#installation-in-bare-react-native).
+
+## Installation in bare React Native
+
+This library is an [Expo Module](https://docs.expo.dev/modules/overview/) and therefore requires `expo-modules-core` as a peer. If your project does not use the Expo managed workflow you will need to set this up manually.
+
+### 1. Install
+
+```sh
+npm install @wwdrew/expo-spotify-sdk expo-modules-core
+# or
+yarn add @wwdrew/expo-spotify-sdk expo-modules-core
+```
+
+### 2. iOS
+
+Add the pod to your `Podfile`:
+
+```ruby
+pod 'ExpoSpotifySDK', :path => '../node_modules/@wwdrew/expo-spotify-sdk'
+```
+
+Then install pods:
+
+```sh
+cd ios && pod install
+```
+
+If you have not already bootstrapped `expo-modules-core` in your AppDelegate, follow the [Expo Modules integration guide](https://docs.expo.dev/bare/installing-expo-modules/) first — in particular, your `AppDelegate` must inherit from `ExpoAppDelegate` (or call `ExpoModulesAppDelegateSubscriber`) so that the Spotify redirect URL is handled correctly.
+
+Finally, register your URL scheme. In Xcode open **Info → URL Types** and add a new entry with:
+
+- **Identifier:** `$(PRODUCT_BUNDLE_IDENTIFIER)`
+- **URL Schemes:** the value you'll pass as `scheme` in the plugin config (e.g. `myapp`)
+
+### 3. Android
+
+You do **not** need to modify `AndroidManifest.xml`. The module's own manifest (merged by Gradle at build time) already contributes the `<queries>` block for package-visibility and the `<meta-data>` placeholders. The Spotify Auth SDK's AAR brings in its own activities the same way.
+
+The only manual step is in `android/app/build.gradle`. Add the Spotify Auth SDK dependency and populate the manifest placeholders that the module expects:
 
-Include the `expo-spotify-sdk` plugin in your `app.json/app.config.js` file with its required configuration:
+```groovy
+android {
+    defaultConfig {
+        // ...
+        manifestPlaceholders = [
+            spotifyClientId:       "your-spotify-client-id",
+            spotifyRedirectUri:    "myapp://spotify-auth",
+            redirectSchemeName:    "myapp",
+            redirectHostName:      "spotify-auth",
+            redirectPathPattern:   "/.*"
+        ]
+    }
+}
+
+dependencies {
+    // ...
+    implementation 'com.spotify.android:auth:4.0.1'
+    implementation 'com.squareup.okhttp3:okhttp:4.12.0' // required for token swap/refresh
+}
+```
+
+Replace `myapp`, `spotify-auth`, and `your-spotify-client-id` with your own values. Make sure the redirect URI matches what is registered in your [Spotify Developer Dashboard](https://developer.spotify.com/dashboard).
+
+## Configuration
 
-```javascript
-  ...
-  "plugins": [
-    ["@wwdrew/expo-spotify-sdk", {
-      "clientID": "<your-spotify-client-id>",
-      "scheme": "expo-spotify-sdk-example",
-      "host": "authenticate"
-    }]
+Add the plugin to your `app.config.ts` (or `app.json`):
+
+```ts
+export default {
+  plugins: [
+    [
+      "@wwdrew/expo-spotify-sdk",
+      {
+        clientID: "your-spotify-client-id",
+        scheme: "myapp",
+        host: "spotify-auth",
+        // Optional: path pattern accepted by the Spotify Android SDK redirect.
+        // Defaults to "/.*" (matches any path). Change this only if you have a
+        // specific redirect path registered in your Spotify app settings.
+        redirectPathPattern: "/.*",
+      },
+    ],
   ],
-  ...
+};
 ```
 
-Required:
+### Plugin options
+
+| Option                | Type     | Required | Description                                                |
+| --------------------- | -------- | -------- | ---------------------------------------------------------- |
+| `clientID`            | `string` | ✅       | Your Spotify application's Client ID                       |
+| `scheme`              | `string` | ✅       | URL scheme registered for your app (e.g. `"myapp"`)        |
+| `host`                | `string` | ✅       | Host component of the redirect URI (e.g. `"spotify-auth"`) |
+| `redirectPathPattern` | `string` | —        | Android redirect path regex. Defaults to `"/.*"`           |
+
+The redirect URI registered in your [Spotify Developer Dashboard](https://developer.spotify.com/dashboard) must match `{scheme}://{host}` exactly (e.g. `myapp://spotify-auth`).
+
+## Usage
+
+```ts
+import {
+  isAvailable,
+  authenticateAsync,
+  refreshSessionAsync,
+  addSessionChangeListener,
+  SpotifyError,
+} from "@wwdrew/expo-spotify-sdk";
+
+// Check whether the Spotify app is installed
+const spotifyInstalled = isAvailable();
+
+// Authenticate
+try {
+  const session = await authenticateAsync({
+    scopes: ["user-read-email", "streaming"],
+    tokenSwapURL: "https://your-server.example.com/swap",
+    tokenRefreshURL: "https://your-server.example.com/refresh",
+  });
+
+  console.log(session.accessToken); // use with Spotify Web API
+  console.log(session.refreshToken); // store securely for later refresh
+  console.log(session.expirationDate); // Unix epoch milliseconds
+  console.log(session.scopes); // granted scopes
+} catch (e) {
+  if (e instanceof SpotifyError) {
+    if (e.code === "USER_CANCELLED") return; // user backed out — benign
+    console.error(`[${e.code}] ${e.message}`);
+  }
+}
+```
 
-- `clientID`: &lt;string&gt; the Spotify Client ID for your application
-- `scheme`: &lt;string&gt; the [URL scheme](https://docs.expo.dev/versions/latest/config/app/#scheme) to link into your app as part of the redirect URI
-- `host`: &lt;string&gt; the path of the redirect URI
+### Refresh a session
 
-## API Reference
+```ts
+import { refreshSessionAsync } from "@wwdrew/expo-spotify-sdk";
 
-```typescript
-isAvailable(): boolean`
+const refreshed = await refreshSessionAsync({
+  refreshToken: storedRefreshToken,
+  tokenRefreshURL: "https://your-server.example.com/refresh",
+});
 ```
 
-Determines if the Spotify app is installed on the target device.
+## API reference
+
+### `isAvailable(): boolean`
+
+Returns `true` if the Spotify app is installed on the device. Always returns `false` on web. Does not throw.
 
 ---
 
-```typescript
-authenticateAsync(config: SpotifyConfig): Promise<SpotifySession>
-```
+### `authenticateAsync(config: SpotifyConfig): Promise<SpotifySession>`
 
-Starts the authentication process. Requires an array of OAuth scopes. If the Spotify app is installed on the target device it will interact directly with it, otherwise it will open a web view to authenticate with the Spotify website.
+Starts a Spotify OAuth flow. If the Spotify app is installed it authenticates natively; otherwise it falls back to the Spotify web login page.
 
-**Note for Android:** If not providing a token swap or refresh URL, the Spotify session response access token will expire after 60 minutes and will not include a refresh token. This is due to a limitation in the Android Spotify SDK. It's recommended to [implement a token swap endpoint](#token-swap) for this reason.
+**Throws [`SpotifyError`](#spotifyerror)** on failure.
 
-### Parameters
+**Parameters (`SpotifyConfig`):**
 
-- `tokenSwapURL` (optional): &lt;string&gt; The URL to use for attempting to swap an authorization code for an access token
-- `tokenRefreshURL` (optional): &lt;string&gt; The URL to use for attempting to renew an access token with a refresh token
-- `scopes`: An array of OAuth scopes that declare how your app wants to access a user's account. See [Spotify Scopes](https://developer.spotify.com/web-api/using-scopes/) for more information.
+| Field             | Type             | Required | Description                                                                                                                |
+| ----------------- | ---------------- | -------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `scopes`          | `SpotifyScope[]` | ✅       | OAuth scopes to request. Must contain at least one entry.                                                                  |
+| `tokenSwapURL`    | `string`         | —        | URL of your token swap server endpoint. Triggers CODE flow (recommended). Required on Android to receive a `refreshToken`. |
+| `tokenRefreshURL` | `string`         | —        | URL of your token refresh server endpoint. Used by iOS SDK natively and by `refreshSessionAsync` on both platforms.        |
 
-**Note:** The following scopes are not available to Expo Spotify SDK:
+**Returns (`SpotifySession`):**
 
-  - user-read-playback-position
-  - user-soa-link
-  - user-soa-unlink
-  - user-manage-entitlements
-  - user-manage-partner
-  - user-create-partner
+| Field            | Type             | Description                                                                                                                                         |
+| ---------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `accessToken`    | `string`         | OAuth access token. Use as `Authorization: Bearer <token>` with the Spotify Web API.                                                                |
+| `refreshToken`   | `string \| null` | Refresh token. `null` on Android when no `tokenSwapURL` is provided — see [Android implicit flow](#android-implicit-token-flow-is-not-recommended). |
+| `expirationDate` | `number`         | Token expiry as Unix epoch **milliseconds**.                                                                                                        |
+| `scopes`         | `SpotifyScope[]` | Granted scopes. On Android TOKEN flow, reflects requested scopes (Spotify does not expose granted scopes in the implicit flow).                     |
 
-### Types
+---
 
-```typescript
-interface SpotifyConfig {
-  scopes: SpotifyScope[];
-  tokenSwapURL?: string;
-  tokenRefreshURL?: string;
-}
+### `refreshSessionAsync(options): Promise<SpotifySession>`
+
+Exchanges a refresh token for a new access token via your token refresh server.
+
+**Parameters:**
+
+| Field             | Type     | Description                                                 |
+| ----------------- | -------- | ----------------------------------------------------------- |
+| `refreshToken`    | `string` | The refresh token from a previous `authenticateAsync` call. |
+| `tokenRefreshURL` | `string` | URL of your token refresh server endpoint.                  |
+
+**Returns** a fresh `SpotifySession` with an updated `accessToken` and `expirationDate`. If the server rotates the refresh token the new one is returned in `refreshToken`; otherwise the original token is returned so you can continue refreshing.
+
+---
+
+### `addSessionChangeListener(listener): Subscription`
+
+Subscribes to session lifecycle events emitted by the native module. Events fire for every `authenticateAsync` and `refreshSessionAsync` call — including ones you didn't directly `await` — making this the right place to persist tokens in a central store.
 
-interface SpotifySession {
-  accessToken: string;
-  refreshToken: string | null;
-  expirationDate: number;
-  scopes: SpotifyScopes[];
+Returns a `Subscription` object; call `.remove()` to unsubscribe.
+
+```ts
+import { addSessionChangeListener } from "@wwdrew/expo-spotify-sdk";
+
+const sub = addSessionChangeListener((event) => {
+  switch (event.type) {
+    case "didInitiate":
+    case "didRenew":
+      store.setSession(event.session); // { accessToken, refreshToken, expirationDate, scopes }
+      break;
+    case "didFail":
+      console.error(`[${event.error.code}] ${event.error.message}`);
+      break;
+  }
+});
+
+// When the subscribing component unmounts:
+sub.remove();
+```
+
+**Event types (`SpotifySessionChangeEvent`):**
+
+| `type` | Payload | Fired when |
+|---|---|---|
+| `"didInitiate"` | `{ session: SpotifySession }` | `authenticateAsync` succeeded |
+| `"didRenew"` | `{ session: SpotifySession }` | `refreshSessionAsync` succeeded |
+| `"didFail"` | `{ error: { code, message } }` | Either function rejected |
+
+---
+
+### `SpotifyError`
+
+All rejections from `authenticateAsync` and `refreshSessionAsync` are instances of `SpotifyError`:
+
+```ts
+import { SpotifyError } from "@wwdrew/expo-spotify-sdk";
+
+try {
+  await authenticateAsync({ scopes: ["streaming"] });
+} catch (e) {
+  if (e instanceof SpotifyError) {
+    switch (e.code) {
+      case "USER_CANCELLED": // user closed the auth screen — benign
+      case "AUTH_IN_PROGRESS": // concurrent call — benign
+        return;
+      case "INVALID_CONFIG": // missing clientID / scopes / tokenSwapURL
+      case "NETWORK_ERROR": // connectivity failure during token swap
+      case "TOKEN_SWAP_FAILED": // swap server returned non-2xx (e.message has status + body)
+      case "TOKEN_SWAP_PARSE_ERROR": // swap server returned invalid JSON
+      case "SPOTIFY_NOT_INSTALLED": // Spotify app not found (rare — most flows fall back to web)
+      case "AUTH_ERROR": // Spotify returned an error (e.message has detail)
+      case "UNKNOWN": // unexpected failure
+        reportError(e);
+    }
+  }
 }
+```
+
+## Android implicit (TOKEN) flow is not recommended
+
+When `authenticateAsync` is called on Android **without** a `tokenSwapURL`, the Spotify Android SDK uses the implicit (TOKEN) flow. This flow has two hard limitations that **will not be fixed** — Spotify has deprecated it:
+
+1. **No `refreshToken`.** The Android SDK does not expose a refresh token for implicit grants. `session.refreshToken` will always be `null`.
+2. **`scopes` reflects what was requested, not what was granted.** The Android SDK does not return the actual granted scope list for TOKEN responses.
+
+The library emits a one-time `console.warn` at runtime when this path is taken.
+
+**The fix:** provide a `tokenSwapURL` to use the Authorization Code flow, which returns a full `refreshToken` and the actual granted `scopes` on both platforms.
+
+See [Spotify's migration guide](https://developer.spotify.com/documentation/android/tutorials/migration-token-code) for context, and the [token swap server section](#token-swap-server) below for a reference implementation.
+
+## Token swap server
+
+The `tokenSwapURL` / `tokenRefreshURL` endpoints must be a server you control — **never** put your Spotify `CLIENT_SECRET` in the app bundle.
+
+### Swap endpoint (`POST {tokenSwapURL}`)
+
+The native module sends a `application/x-www-form-urlencoded` body:
 
-type SpotifyScopes =
-  | "ugc-image-upload"
-  | "user-read-playback-state"
-  | "user-modify-playback-state"
-  | "user-read-currently-playing"
-  | "app-remote-control"
-  | "streaming"
-  | "playlist-read-private"
-  | "playlist-read-collaborative"
-  | "playlist-modify-private"
-  | "playlist-modify-public"
-  | "user-follow-modify"
-  | "user-follow-read"
-  | "user-top-read"
-  | "user-read-recently-played"
-  | "user-library-modify"
-  | "user-library-read"
-  | "user-read-email"
-  | "user-read-private";
+```
+code=<authorization-code>&redirect_uri=<redirect-uri>&client_id=<client-id>
 ```
 
-## Token Swap Example
+Your server POSTs these to `https://accounts.spotify.com/api/token` with `grant_type=authorization_code` and your `CLIENT_SECRET` in the `Authorization` header, then returns Spotify's response verbatim as `application/json`:
 
-An example token swap endpoint has been provided in the `example` project. For it to work it needs your Spotify client details to be included.
+```json
+{
+  "access_token": "BQA...",
+  "token_type": "Bearer",
+  "expires_in": 3600,
+  "refresh_token": "AQA...",
+  "scope": "user-read-email streaming"
+}
+```
+
+### Refresh endpoint (`POST {tokenRefreshURL}`)
 
-1. Open the `server.js` file and add your client details:
+The native module sends:
 
-```javascript
-const CLIENT_ID = "<your-client-id>";
-const CLIENT_SECRET = "<your-client-secret>";
 ```
+refresh_token=<token>&client_id=<client-id>
+```
+
+Your server POSTs to `https://accounts.spotify.com/api/token` with `grant_type=refresh_token`. Return Spotify's response verbatim. If Spotify rotates the refresh token the response will contain a new `refresh_token`; if not, the field is absent — the library handles both cases correctly.
+
+### Error responses
+
+Return a non-2xx HTTP status with a JSON body for structured error propagation. The library will reject with `TOKEN_SWAP_FAILED` and include the status code and (truncated) response body in `e.message`.
 
-These values can be found in your [Spotify Developer Dashboard](https://developer.spotify.com/dashboard). You will need an existing Spotify app for this.
+### Reference implementation
 
-2. Run the server
+The example app uses [Expo Router API routes](https://docs.expo.dev/router/reference/api-routes/) for the swap and refresh endpoints — no separate server process needed.
+
+**Before running the example, you need a Spotify app:**
+
+> **Note (February 2026 onwards):** Spotify now requires the app owner to have an active **Spotify Premium** subscription to use Development Mode apps. Development Mode apps are also limited to **5 test users** — each user must be explicitly added in your Dashboard under **User Management**. See [Spotify's February 2026 migration guide](https://developer.spotify.com/documentation/web-api/tutorials/february-2026-migration-guide) for details.
+
+1. Go to [developer.spotify.com/dashboard](https://developer.spotify.com/dashboard) and create an app (or use an existing one).
+2. In the app settings, under **APIs used**, enable **Web API** (required for the `/v1/me` profile call).
+3. Under **Redirect URIs**, add `expo-spotify-sdk-example://authenticate` exactly and save.
+4. Under **User Management**, add the Spotify accounts that will test the app (up to 5 in Development Mode).
+
+**Then populate the credentials:**
 
 ```sh
-node server.js
+cd example
+cp .env.local.example .env.local
 ```
 
-3. Set the `tokenSwapURL` value in your `authenticateAsync` call:
+Edit `.env.local` — all three values are required:
 
-```javascript
-const session = await authenticateAsync({
-  tokenSwapURL: "http://192.168.1.120:3000/swap",
-  scopes: [
-    ...
-  ]
-});
+```sh
+# From your Spotify app's dashboard page
+SPOTIFY_CLIENT_ID=your_client_id_here
+SPOTIFY_CLIENT_SECRET=your_client_secret_here
+
+# Must match the redirect URI you registered in the Spotify Dashboard
+SPOTIFY_REDIRECT_URI=expo-spotify-sdk-example://authenticate
 ```
 
-All authentication requests will now be sent through the token swap server.
+`SPOTIFY_CLIENT_ID` and `SPOTIFY_CLIENT_SECRET` are shown on your app's dashboard page. `SPOTIFY_CLIENT_SECRET` is revealed by clicking **View client secret**.
+
+**Then run the app:**
+
+```sh
+npx expo start
+```
+
+The `/swap` and `/refresh` API routes are served by the Expo dev server alongside the app. `Constants.expoConfig.hostUri` auto-detects the correct server URL for any device or simulator — no manual IP configuration needed.
+
+## Troubleshooting
+
+**`INVALID_CONFIG: Missing meta-data 'spotifyClientId'`**
+Run `expo prebuild` after adding the plugin to your config. The plugin injects the required `AndroidManifest.xml` entries.
+
+**`isAvailable()` returns `false` on Android 11+ release builds**
+Android 11+ requires a `<queries>` element to inspect other apps' package names. The module ships this in its `AndroidManifest.xml`; make sure you are not merging a custom manifest that removes it.
+
+**iOS: authentication never returns**
+Ensure your app's URL scheme is registered in Xcode under **Info → URL Types** and that it matches the `scheme` in the plugin config. The `expo prebuild` step does this automatically; if you have a bare workflow, check `CFBundleURLSchemes` in `Info.plist`.
 
-## Acknowledgments
+**`AUTH_IN_PROGRESS`**
+`authenticateAsync` was called while a previous call was still pending. Wait for the first call to resolve or reject before calling again.
 
-This project has been heavily inspired by the following projects:
+## Acknowledgements
 
-* [react-native-spotify-remote](https://github.com/cjam/react-native-spotify-remote)
-* [expo-spotify](https://github.com/kvbalib/expo-spotify)
+Inspired by [react-native-spotify-remote](https://github.com/cjam/react-native-spotify-remote) and [expo-spotify](https://github.com/kvbalib/expo-spotify).
 
-## Contribute
+## Contributing
 
-Contributions are welcome!
+See [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## License
 
-MIT
+MIT — see [LICENSE](LICENSE).

package/android/build.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'com.android.library'
 
 group = 'expo.modules.spotifysdk'
-version = '0.1.1'
+version = '0.5.0'
 
 def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
 apply from: expoModulesCorePlugin
@@ -9,25 +9,24 @@ applyKotlinExpoModulesCorePlugin()
 useCoreDependencies()
 useExpoPublishing()
 
-// If you want to use the managed Android SDK versions from expo-modules-core, set this to true.
-// The Android SDK versions will be bumped from time to time in SDK releases and may introduce breaking changes in your module code.
-// Most of the time, you may like to manage the Android SDK versions yourself.
-def useManagedAndroidSdkVersions = false
-if (useManagedAndroidSdkVersions) {
-  useDefaultAndroidSdkVersions()
-} else {
-  buildscript {
-    // Simple helper that allows the root project to override versions declared by this library.
-    ext.safeExtGet = { prop, fallback ->
-      rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
-    }
+buildscript {
+  ext.safeExtGet = { prop, fallback ->
+    rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
   }
-  project.android {
-    compileSdkVersion safeExtGet("compileSdkVersion", 34)
-    defaultConfig {
-      minSdkVersion safeExtGet("minSdkVersion", 21)
-      targetSdkVersion safeExtGet("targetSdkVersion", 34)
-    }
+}
+
+project.android {
+  compileSdkVersion safeExtGet("compileSdkVersion", 35)
+  defaultConfig {
+    minSdkVersion safeExtGet("minSdkVersion", 24)
+    targetSdkVersion safeExtGet("targetSdkVersion", 35)
+  }
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_17
+    targetCompatibility JavaVersion.VERSION_17
+  }
+  kotlinOptions {
+    jvmTarget = "17"
   }
 }
 
@@ -35,14 +34,21 @@ android {
   namespace "expo.modules.spotifysdk"
   defaultConfig {
     versionCode 1
-    versionName "0.1.1"
+    versionName "0.5.0"
+    consumerProguardFiles "consumer-rules.pro"
   }
   lintOptions {
     abortOnError false
   }
 }
 
+repositories {
+  mavenCentral()
+}
+
 dependencies {
-   implementation 'com.squareup.okhttp3:okhttp:4.9.2'
-   implementation "com.spotify.android:auth:2.1.2"
+  implementation "com.spotify.android:auth:4.0.1"
+  implementation "com.squareup.okhttp3:okhttp:4.12.0"
+  implementation "org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.1"
+  implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.1"
 }

package/android/consumer-rules.pro

@@ -0,0 +1,8 @@
+# Keep Spotify Auth SDK classes
+-keep class com.spotify.sdk.android.auth.** { *; }
+-keepclassmembers class com.spotify.sdk.android.auth.** { *; }
+-dontwarn com.spotify.sdk.android.auth.**
+
+# Keep our module's data classes
+-keep class expo.modules.spotifysdk.** { *; }
+-keepclassmembers class expo.modules.spotifysdk.** { *; }

package/android/src/main/AndroidManifest.xml

@@ -1,5 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <queries>
+        <package android:name="com.spotify.music" />
+    </queries>
     <application>
         <meta-data
             android:name="spotifyClientId"