I stopped using Mopidy when I started having weird playlists and song history crop up in my account. Very clearly nothing I'd played.

Best I can guess either there's a market in cracked auth tokens for the interface Mopidy use(s/d), or there's some sort of collision going on.

Changed password, de-authed Mopidy and shut it off, and all of a sudden the random crap stopped.

The way auth tokens are setup for Mopidy-Spotify you hold the encryption key for the blob with the OAuth data, and the intermediate server just has an id and the encrypted data. Note that the id is not a Spotify OAuth client-id but an internal one. This is done so we don't have to ship Mopidy-Spotify with the client-secret for the App registration (this was pre PKCE auth).

I.e. I would be highly surprised if our OAuth integration was the source for this issue, but I'm obviously biased as the author of https://github.com/adamcik/oauthclientbridge

As for libspotify, there you had to put in a (device) password and username, so if something scraped that config I guess all bets are off...

This happened to me using the official client. All was well after password change.

Turns out, spotify gets their data breached regularly and I'm assuming that's the case here.

It happened to me and my brother too (in separate occasions), with the official client.

The data and music "being played" with our accounts seemed so random and niche that I doubt that it was result of human interaction, seemed like something wrong with their DB. Also, changing the password didn't fix it.

Had to change the password and also delete all the data in the account, losing also my data of course. It had so much garbage that it was pretty much ruined anyway

Is this an alternative? https://github.com/librespot-org/librespot

Yes, that uses the non-public API for smart speakers and the likes. If and how Spotify can crack down on this is not well known at this point, but here's hoping they're using API keys from an old but popular device that's no longer receiving updates.

My raspotify/librespot install stopped working last week until i blocked apresolve.spotify.com on my network.

It seems they are switching some regions to a CDN that is not supported by librespot. There is some discussion on the librespot issues github page (https://github.com/librespot-org/librespot/issues/972)

Yeah it sucks, I found mopidy-spotify to be janky in it's usage but it was the least worst means of playing audio from various backends. It doesn't look like there's much hope for it in the future https://github.com/mopidy/mopidy-spotify

edit: after looking a little deeper it seems there is indeed quite some activity and hope https://github.com/mopidy/mopidy-spotify/issues/110

AFAICT the community of unixy-hackers who used libspotify had moved on to librespot, eg. with spotifyd. Though of course, I don't know about every use case, and mopidy does seem stuck with the web api instead, which is weird considering the rise in popularity of spotifyd and spotify-tui.

The plan for mopidy-spotify was to move towards web-api for everything we could to be on the official APIs where possible. So the end state would have been only streaming left on libspotify, then figure out how to get librespot and GStreamer to play well enough together (there is a plugin but it's missing at least one feature we need).

But as you can see in issue #110 this goal hasn't been reached yet.

Isn't a library like this essential for companies that build e.g. active speakers which support streaming from Spotify?

So, shouldn't there be an official library?

There is an SDK behind a "Contact Us" button and presumably an NDA. librespot uses that API.