Prerequisites

List of Things Needed

• clientId
• clientSecret
• redirectURI
• PKCECodeChallenge
• PKCECodeVerifier

Register Your App

Aquired in this step:

• clientId
• clientSecret

Submit App Proposal

Before starting you will need to register your application with Soundcloud. From doing so you will gain a clientId and a clientSecret. Register an application here by submitting a ticket in the chat box in the bottom right. You should eventually recieve an email from Soundcloud customer support, who will ask you what the purpose of your app is etc before granting you access.

Where to Find clientId And clientSecret

After Soundcloud grant you access you can access the clientId and clientSecret at https://soundcloud.com/you/apps.

redirectURI

Aquired in this step

• redirectURI

Choosing Your redirectURI

The redirectURI is a link that the user will be redirected to after they authorize your app to have access to their Soundcloud. The URI the user is redirected to will then at some point call your back end to make requests to the Soundcloud API, so think about what URI this needs to be for your app.

Example redirectUri Flow

• User clicks "Connect to Soundcloud" button on your site
• User is redirected to Soundcloud,
• User authorizes your app
• user is then sent back to your redirectUri

For further details on this and beyond see See Logged In Auth Flow.

Setting redirectURI

You will need to add a redirectURI to your app in Soundcloud. This can only be changed by Soundcloud. So if you are looking to change it yourself at https://soundcloud.com/you/apps, you will not be able to. In the same email chain you created your app proposal ticket you can request Soundcloud set up a redirectURI. You can have a maximum of 3 redirectURIs per app so I reccomend at least one of those be a development domain, e.g. http://localhost:3000.

PKCE

Aquired in this step:

• PKCECodeChallenge
• PKCECodeVerifier

Soundcloud API uses a PKCE code challenge as an additional layer of security. You can read more about it here. You can generate your PKCE code challenge and verifier here. The code challenge will be sent from the client so is safe to expose, but do not expose your code verifier. Ensure it is stored securely and only used in your back end.