Hello!
Thanks for bringing this up, the topic is important and goes way beyond Spotify.
Why it’s blocked
Spotify tightened its security rules at the beginning of 2025 (applied to new apps since April 9, 2025, and to all apps since November 2025). An OAuth redirect URL is now only accepted if:
- it is in HTTPS, or
- it’s an explicit loopback address:
http://127.0.0.1:PORT or http://[::1]:PORT.
localhost is no longer accepted, and a local IP in HTTP (http://192.168.1.50) is not either. Yet, this is exactly how most of you access Gladys at home: a local IP, in HTTP, without a certificate. Hence the famous redirect_uri: Not matching configuration.
This is a common issue for all self-hosted projects; Home Assistant faced the same problem.
The workaround for now
The one mentioned by @Will_71 works: declare the Gladys callback URL on Spotify’s side by replacing the local IP with 127.0.0.1 (keeping the port and path exactly the same), then launch the authorization from a browser running on the machine where Gladys is installed, or via an SSH tunnel (ssh -L) from your PC.
It works because Spotify only checks that the URL matches character by character; it never needs to join it itself.
But let’s be honest: it’s perfect for tinkerers, and unusable for someone who controls their Gladys from their phone. This is not an acceptable long-term solution.
The real solution: an official Gladys redirect URL
I will set up an official HTTPS redirect URL, hosted by Gladys, on the same principle as what Home Assistant does with my.home-assistant.io.
The principle:
- This official URL (in HTTPS, therefore accepted by Spotify) is the one you declare in your Spotify app; no need for a certificate or a domain name at your end.
- After your authorization, Spotify redirects to this page, which simply redirects your browser to your local Gladys, with a confirmation screen clearly indicating the address you will be redirected to.
- Your instance completes the exchange itself and stores the tokens locally.
Important point on privacy: this page is entirely static, with no server behind it. Your Spotify credentials, access tokens, and data never pass through our servers; the page only does a redirect in your browser, exactly like Home Assistant does.
Other advantages:
- it will work for all external integrations that use an OAuth2 connection, not just Spotify;
- no need for Gladys Plus or subscription: it’s available to everyone;
- for those who already have an HTTPS URL (domain name, reverse proxy), you can continue to use yours.
I’ll take care of the setup and get back to you here as soon as it’s available, with the updated documentation. In the meantime, the 127.0.0.1 workaround above allows you to get by.
Thanks for reporting the issue 