Apple Music

No OAuth

domain not confirmedUpdated 28 Oct 2026 · today

The Apple Music API (api.music.apple.com, from Apple Inc.) uses two tokens and no OAuth flow. Your app signs a JWT developer token with your MusicKit private key from the Apple Developer Program. The user's Music-User-Token comes from Apple's MusicKit SDKs: MusicKit for Swift on Apple platforms, MusicKit on the Web, or MusicKit for Android. There is no OAuth authorize endpoint, redirect URI, authorization code or refresh token. Sign in with Apple is OAuth 2.0, but it only supports the 'name' and 'email' scopes, so it can't grant Apple Music access. Users connect by approving the MusicKit prompt inside your app or web page. Your app then stores the Music-User-Token and sends it in the Music-User-Token header, next to the developer token.

Saved, so nobody researches it twice.Think it’s wrong?

Sources

1User Authentication for MusicKit | Apple Developer Documentation
2Generating Developer Tokens | Apple Developer Documentation
3scope | Sign in with Apple JS | Apple Developer Documentation

Feedback

On the version researched 28 Oct 2026