PKCE instead of oauth, --logout feature, uv sync instead of pip install, removed readme banner, updated and linted readme

Author: donmerendolo

README.md

@@ -1,54 +1,60 @@
-> [!CAUTION]
-> **THIS PROJECT IS UNMAINTAINED**
->
-> As of [March 9, 2026](https://developer.spotify.com/blog/2026-02-06-update-on-developer-access-and-platform-security), Spotify requires an active Premium subscription to use their API. Since I don't have one, I'm unable to add features or fix bugs. If Spotify reverts this change, I'll continue maintaining it.
-
 # exportify-cli
+
 ![exportify-cli](image.png)
 
 Export Spotify playlists to CSV or JSON directly from the terminal, inspired by [pavelkomarov/exportify](https://github.com/pavelkomarov/exportify).
 
 This tool can export all saved playlists, including liked songs.
 
 ## Installation:
+
 **You can also download a binary from the [releases page](https://github.com/donmerendolo/exportify-cli/releases/latest) and skip steps 1 and 2. It's recommended to place it in a dedicated folder since it will create .cache, a config file and playlists folders.**
 1. **Clone this repository:**
+
 ```bash
 git clone https://github.com/donmerendolo/exportify-cli.git
 ```
-
 2. **Install the required packages:**
-(recommended to use a virtual environment)
+
 ```bash
 cd exportify-cli
-pip install -r requirements.txt
+uv sync
 ```
 
-3. **Set up Client ID, Client Secret and Redirect URI:**
+3. **Set up Client ID, a Redirect URI and a refresh token:**
 
 The first time you run exportify-cli, it will guide you through the setup:
+
 ```
 File "config.cfg" not found or invalid. Let's create it.
+Use a Client ID and Redirect URI that belong to the same Spotify app.
+
+Spotify Client ID: 
+Redirect URI: 
+```
 
-1. Go to Spotify Developer Dashboard (https://developer.spotify.com/dashboard).
-2. Create a new app.
-3. Set a name and description for your app.
-4. Add a redirect URI (e.g. http://127.0.0.1:3000/callback).
+If no valid `.cache` token is found, exportify-cli asks for a `refresh_token` once to bootstrap authentication. Spotipy then manages and refreshes tokens automatically using the `.cache` file, so you won't have to enter it again unless you log out or revoke access:
 
-Now after creating the app, press the Settings button on the upper right corner.
-Copy the Client ID, Client Secret and Redirect URI and paste them below.
+```
+No valid Spotify token cache found. Enter your refresh token.
+Spotify refresh token: 
 ```
 
-After running `python exportify-cli.py` (or [one of the binaries](https://github.com/donmerendolo/exportify-cli/releases/latest)) the first time, it should keep you authenticated so you don't have to log in each time.
+If you wish to log out, run:
 
-If you wish to log out, simply remove the `.cache` file (you may also have to remove access to `exportify-cli` in https://www.spotify.com/us/account/apps/).
+```bash
+python exportify-cli.py --logout
+```
+
+You may also revoke access in https://www.spotify.com/us/account/apps/.
 
 ---
 
 ## Usage:
+
 ```
-Usage: exportify-cli.py (-a | -p NAME|ID|URL|URI [-p ...] | -u ID|URL|URI |
--l) [OPTIONS]
+Usage: exportify-cli.py (-a | -p NAME|ID|URL|URI [-p ...] | -u ID|URL|URI | -l
+| --logout) [OPTIONS]
 
   Export Spotify playlists to CSV or JSON.
 
@@ -60,6 +66,7 @@ Options:
     -u, --user ID|URL|URI         Export all public playlists of a Spotify
                                   user given ID, URL, or URI; repeatable.
     -l, --list                    List available playlists.
+    --logout                      Delete cached Spotify auth token and exit.
     -c, --config PATH             Path to configuration file (default is
                                   ./config.cfg next to this script).
     -o, --output PATH             Directory to save exported files (default is
@@ -75,20 +82,15 @@ Options:
   -h, --help                      Show this message and exit.
   -v, --version                   Show the version and exit.
 ```
-
 - Default values can be changed in `config.cfg`.
-
 - Playlist names support partial matching, provided they uniquely identify a single playlist.
-
 - You can also export a playlist that's not saved in your library by using its ID, URL, or URI.
-
 - A single command can export multiple playlists by using the `-p` option multiple times. Same applies for the `-u` option.
-
 - You can export all ***public*** playlists of any user by using the `-u` option with their user ID, URL, or URI. It won't save Liked Songs from that user, as it's private.
-
 - The default fields are: `Position`, `Track URI`, `Track Name`, `Album Name`, `Artist Name(s)`, `Release Date`, `Duration_ms`, `Popularity`, `Added By`, `Added At`, `Record Label`. With flags, `Album URI(s)`, `Artist URI(s)`, `Track ISRC` and `Album UPC` can be included too. If you want any other field to be added, feel free to open an issue or PR.
 
 ### Examples:
+
 ```
 # List all saved playlists
 python exportify-cli.py --list
@@ -115,7 +117,9 @@ python exportify-cli.py -u spotifyuser123 -u https://open.spotify.com/user/anoth
 ---
 
 ## Building:
+
 You can use [PyInstaller](https://pyinstaller.readthedocs.io/en/stable/) to build a binary with this command:
+
 ```bash
 pyinstaller --onefile .\exportify-cli.py
 ```

exportify-cli.py

@@ -13,7 +13,7 @@
 import spotipy
 from click_option_group import OptionGroup, optgroup
 from pathvalidate import sanitize_filename
-from spotipy.oauth2 import SpotifyOAuth
+from spotipy.oauth2 import SpotifyOauthError, SpotifyPKCE
 from tabulate import tabulate
 from tqdm.auto import tqdm
 
@@ -65,13 +65,18 @@ def get_version():
         return "0.0.0"
 
 
+def get_token_cache_path() -> Path:
+    """Return the path used by Spotipy to cache auth tokens."""
+    return Path(__file__).parent / Path(".cache")
+
+
 def validate_config(config: configparser.ConfigParser) -> bool:
     """Validate that the Spotify section exists and has all required keys, and that the redirect URI is valid."""
     if not config.has_section("spotify"):
         logger.error("Configuration missing [spotify] section.")
         return False
     spotify_cfg = config["spotify"]
-    required = ("client_id", "client_secret", "redirect_uri")
+    required = ("client_id", "redirect_uri")
     missing = [k for k in required if not spotify_cfg.get(k, "").strip()]
     if missing:
         logger.error(
@@ -114,27 +119,17 @@ def load_config(config_path: Path) -> configparser.ConfigParser:
         return config
     # Prompt user to create config
     logger.info(f"Config not found or invalid at {config_path}, creating new.")
-    click.echo("""File "config.cfg" not found or invalid. Let's create it.
-
-1. Go to Spotify Developer Dashboard (https://developer.spotify.com/dashboard).
-2. Create a new app.
-3. Set a name and description for your app.
-4. Add a redirect URI (e.g. http://127.0.0.1:3000/callback).
-
-Now after creating the app, press the Settings button on the upper right corner.
-Copy the Client ID, Client Secret and Redirect URI and paste them below.""")
+    click.echo(
+        """File "config.cfg" not found or invalid. Let's create it.
+Use a Client ID and Redirect URI that belong to the same Spotify app.
+"""
+    )
 
     spotify_cfg = {
         "client_id": click.prompt("Spotify Client ID", type=str).strip(),
-        "client_secret": click.prompt(
-            "Spotify Client Secret",
-            hide_input=True,
-            type=str,
-        ).strip(),
         "redirect_uri": click.prompt(
             "Redirect URI",
             type=str,
-            default="http://127.0.0.1:3000/callback",
         ).strip(),
     }
 
@@ -159,15 +154,35 @@ def clean_playlist_input(playlist: list[str]) -> None:
 
 
 def init_spotify_client(cfg: configparser.ConfigParser) -> spotipy.Spotify:
-    """Initialize Spotify client with OAuth manager."""
+    """Initialize Spotify client with PKCE manager."""
     creds = cfg["spotify"]
-    auth = SpotifyOAuth(
+    auth = SpotifyPKCE(
         client_id=creds["client_id"],
-        client_secret=creds["client_secret"],
         redirect_uri=creds["redirect_uri"],
-        scope="playlist-read-private playlist-read-collaborative user-library-read",
-        cache_path=Path(__file__).parent / Path(".cache"),
+        cache_path=get_token_cache_path(),
     )
+
+    try:
+        token_info = auth.get_cached_token()
+    except SpotifyOauthError as err:
+        logger.warning(
+            f"Cached token is invalid or expired and could not be refreshed: {err}"
+        )
+        token_info = None
+
+    if token_info is None:
+        click.echo("No valid Spotify token cache found. Enter your refresh token.")
+        refresh_token = click.prompt("Spotify refresh token", type=str).strip()
+
+        try:
+            auth.refresh_access_token(refresh_token)
+        except SpotifyOauthError as err:
+            logger.error(f"Failed to authenticate with provided refresh token: {err}")
+            click.echo(
+                "Authentication failed. The refresh token is invalid, expired, or revoked.",
+            )
+            sys.exit(1)
+
     return spotipy.Spotify(auth_manager=auth, retries=10)
 
 
@@ -521,7 +536,7 @@ class CustomCommand(click.Command):
     def format_usage(self, ctx, formatter) -> None:
         # Override the usage display
         formatter.write_text(
-            "Usage: exportify-cli.py (-a | -p NAME|ID|URL|URI [-p ...] | -u ID|URL|URI | -l) [OPTIONS]\n",
+            "Usage: exportify-cli.py (-a | -p NAME|ID|URL|URI [-p ...] | -u ID|URL|URI | -l | --logout) [OPTIONS]\n",
         )
 
 
@@ -551,6 +566,12 @@ def format_usage(self, ctx, formatter) -> None:
     is_flag=True,
     help="List available playlists.",
 )
+@optgroup.option(
+    "--logout",
+    "logout",
+    is_flag=True,
+    help="Delete cached Spotify auth token and exit.",
+)
 @optgroup.option(
     "-c",
     "--config",
@@ -623,6 +644,7 @@ def main(
     playlist: tuple[str, ...],
     user: tuple[str, ...],
     list_only: bool,
+    logout: bool,
     config: None | str,
     output_param: str,
     format_param: str,
@@ -633,6 +655,15 @@ def main(
     reverse_order: bool,
 ) -> None:
     """Export Spotify playlists to CSV or JSON."""
+    if logout:
+        token_cache = get_token_cache_path()
+        if token_cache.exists():
+            token_cache.unlink()
+            click.echo('Logged out successfully. Removed token cache file ".cache".')
+        else:
+            click.echo('No token cache file ".cache" was found.')
+        sys.exit(0)
+
     # If no --all, --playlist, --user or --list options are given, show help
     if not (export_all or playlist or user or list_only):
         click.echo(main.get_help(ctx=click.get_current_context()))