Bolt.new AI and Spotify API integration: Step-by-Step Guide 2025

To integrate Bolt.new with the Spotify Web API, you don’t “connect Bolt to Spotify” directly. Instead, you build a normal web server or script inside the Bolt.new workspace that talks to Spotify’s public REST API using OAuth 2.0. Bolt.new just hosts your code while you develop; the integration itself is done through Spotify’s official API endpoints, access tokens, and environment variables. The core workflow is: create a Spotify app in their developer dashboard, get client credentials, handle OAuth inside your Bolt.new server, store tokens in environment variables, call Spotify’s REST endpoints, and test responses in the Bolt embedded preview panel.

 

High‑level workflow (clear answer)

 

You create a Spotify Developer App, copy its Client ID and Client Secret, put them into Bolt.new environment variables, build a tiny API route in Bolt.new (Node/Express) that redirects the user to Spotify’s OAuth consent screen, receives the callback, exchanges the code for an access token, stores it, and then uses fetch to call Spotify’s REST endpoints (for example, get currently playing track). Bolt is only the coding environment; you integrate Spotify like you would in any Node.js project.

 

Detailed guide

 

Below is the exact practical workflow you would follow as a junior developer integrating Spotify inside a Bolt.new project.

• Create a Spotify Developer App at https://developer.spotify.com/dashboard
• Inside the app, set a Redirect URI — for Bolt.new it is typically something like https:///api/auth/callback. You’ll update this once Bolt generates your preview URL.
• Copy your Client ID and Client Secret.
• In Bolt.new, open the environment variable panel and create:
  • SPOTIFY_CLIENT_ID
  • SPOTIFY_CLIENT_SECRET
  • SPOTIFY_REDIRECT_URI

Now you scaffold a small Express server. Bolt.new supports Node projects, so you can drop in an index.js (or any file you prefer) and wire the auth flow.

 

// index.js

import express from "express";
import fetch from "node-fetch";
import dotenv from "dotenv";
dotenv.config();

const app = express();

// Step 1: Redirect user to Spotify auth
app.get("/auth/login", (req, res) => {
  const scope = "user-read-playback-state user-read-currently-playing";
  const redirect = "https://accounts.spotify.com/authorize"
    + "?response_type=code"
    + "&client_id=" + process.env.SPOTIFY_CLIENT_ID
    + "&scope=" + encodeURIComponent(scope)
    + "&redirect_uri=" + encodeURIComponent(process.env.SPOTIFY_REDIRECT_URI);

  res.redirect(redirect);
});

// Step 2: Handle Spotify redirect and exchange code for token
app.get("/api/auth/callback", async (req, res) => {
  const code = req.query.code;

  const tokenResponse = await fetch("https://accounts.spotify.com/api/token", {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body:
      "grant_type=authorization_code"
      + "&code=" + code
      + "&redirect_uri=" + encodeURIComponent(process.env.SPOTIFY_REDIRECT_URI)
      + "&client_id=" + process.env.SPOTIFY_CLIENT_ID
      + "&client_secret=" + process.env.SPOTIFY_CLIENT_SECRET
  });

  const data = await tokenResponse.json();

  // In Bolt.new: usually store token in memory or Bolt's local storage for demo
  global.spotifyAccessToken = data.access_token;

  res.send("Spotify auth success! You can now call /me/playing");
});

// Step 3: Example API call to Spotify
app.get("/me/playing", async (req, res) => {
  if (!global.spotifyAccessToken) {
    return res.status(401).send("No access token, authenticate at /auth/login");
  }

  const r = await fetch("https://api.spotify.com/v1/me/player/currently-playing", {
    headers: {
      Authorization: "Bearer " + global.spotifyAccessToken
    }
  });

  const json = await r.json();
  res.json(json);
});

app.listen(3000, () => console.log("Server running on 3000"));

 

Why this works inside Bolt.new

 

• Bolt.new lets you run Node.js code in a sandboxed dev server.
• You can use normal OAuth flows because Bolt serves real HTTP URLs in the preview panel.
• Spotify does not require any special SDK; the REST API via fetch is enough.
• Environment variables prevent you from hardcoding secrets into your repository.

 

What changes for production

• You must persist tokens (Redis, database, encrypted file) instead of using a global variable.
• You should handle token refresh — Spotify tokens expire in 1 hour but you can refresh them using the refresh token.
• You must register a production redirect URI in Spotify Developer Dashboard.

 

This is the correct, real-world way to integrate a Bolt.new-built app with the Spotify API — using Spotify’s official OAuth flow, storing credentials in Bolt environment variables, and calling the REST endpoints from Node.js.