Hello,
I am developing an application that integrates with Apple Music to provide a personalized music video experience for Apple Music subscribers. We are working on support for many devices like Android TV / Google TV / WebOS / etc. and would like to implement an authorization experience suitable for a television, where entering account credentials with a remote control is cumbersome.
Intended authorization flow
We would like to implement the following experience:
- The application on the TV displays a QR code or short activation code.
- The user scans the QR code with their phone and opens an Apple-hosted authentication and authorization page.
- The user signs in to their Apple Account if necessary and approves Apple Music access for the application on the TV.
- The TV application receives or retrieves the resulting authorization and can use it for the supported Apple Music functionality.
The objective is for the TV application itself to be authorized following approval on the phone, with no need to enter the Apple Account credentials on the television.
Relevant implementation evidence found on Apple’s website
While researching this integration, we examined JavaScript publicly served by link.apple.com.
In the following OAuth view bundle, we observed these identifiers:
PartnerAuthorizationRequestisOffDeviceOAuth2FlowDEVICE_CODE
Source: Apple-hosted OAuth view bundle — oauth-views-OAuth-vue.4db9105e.js
In the associated OAuth initializer bundle, we observed properties including:
client_idscoperesponse_type
Source: Apple-hosted OAuth initializer bundle — oauth-views-OAuthInitializer-vue.23605d03.js
These elements suggest that Apple’s authorization interface includes an off-device authorization path associated with partner clients.
We understand that these implementation details are not public API documentation and do not establish whether this flow is available to third-party developers. We are looking for the officially supported integration and enrollment process, if one is available.
Clarification requested
1. Availability for third-party TV applications
Does Apple offer a supported Apple Music authorization flow of this kind for third-party applications running on non-Apple devices?
If the observed flow is limited to certain integrations or partners, what are the eligibility requirements for obtaining access?
2. Client registration and account configuration
What is the official process for registering or obtaining a client_id authorized to use this flow?
We have reviewed the standard MusicKit configuration involving Media IDs, Media Services keys, App Services and Capability Requests, but have not identified the configuration or application process for off-device authorization.
Could you clarify whether this requires:
- A standard MusicKit Media ID and Media Services key;
- An additional service configuration or managed capability request in the Apple Developer account;
- A separate OAuth client registration;
- Or approval through an Apple Music partner program?
3. Supported integration documentation
If this integration is available, where can we obtain the documentation or SDK covering:
- The required client configuration, request parameters and permitted scopes;
- Creation of the authorization request and the QR code or activation link;
- The mechanism by which the TV checks for completion or receives the result;
- The resulting token type, its intended use, and its expiration or reauthorization requirements?
In particular, we would appreciate clarification on whether the resulting authorization provides a Music User Token usable by the TV application, or another token that requires a documented exchange.
4. Apple Music access on the authorized TV
Which Apple Music APIs or SDKs can consume the resulting authorization? We would like to confirm its supported use with Apple Music API and MusicKit for Android, including any separate requirements for playback on the TV.
Our intended design is for authorization to be issued for the TV application, rather than transferring a Music User Token issued for the phone.
If this access is handled outside the standard MusicKit developer workflow, could you please identify the applicable program and enrollment process, or who to route this request to the Apple Music team responsible for partner authorization and connected-device integrations?
Thank you for helping us identify the supported path for this integration.
Louis
Thanks for laying out the flow you want and the configuration you've already checked.
I didn't find documentation for an off-device or device-code authorization flow, for registering a client_id for one, or for a separate enrollment process. The scripts you found aren't documented API, so I can't comment on them.
User Authentication for MusicKit lists three ways to get a Music User Token: MusicKit on Apple platforms, MusicKit on the Web, and MusicKit for Android. MusicKit on the Web documents authorize(), which "will open the sign-in and authorization flow". The authentication guide in the MusicKit for Android SDK, listed as "Android MusicKit" on the developer downloads page, hands authentication to the Apple Music app. One of its prerequisites is "The user's device must be able to install Apple Music from Google Play."
On your fourth question, Meet Apple Music API and MusicKit says: "A Music User Token is specific to your app and the device the user authenticated on. This token must not be shared across devices, as permission is granted for a single device at a time."
Please file an enhancement request using the Feedback Assistant so that your request can be seen by the appropriate decision makers. Describe the TV authorization flow you want and the devices you're targeting. If you file the request, please post the Feedback number here so we can make sure it gets routed to the right team.
Please note that filing an enhancement request does not guarantee Apple will add any requested functionality to Apple products in the future. However, with that said, filing an enhancement request is a good way to get your ideas in front of the folks who make decisions about that sort of thing.
If you're not familiar with how to file enhancement requests, take a look at Bug Reporting: How and Why?