I have a feeling they didn't use premium accounts since they downloaded at 160kbit/s, which is the highest quality that free accounts can get.

Premium gets 320kbit/s (or lossless)

to use this method of scraping, logging in with a premium account is required.

so either they found a way around that lock, but not the quality lock, or they just decided 160k is good enough (it generally is), and decided to stick with that for filesize & bandwidth savings

I haven't looked at the code but I would be surprised if the premium account "requirement" is anything more than an if statement that can be commented out.

Pretty sure that requirement is server-side?

What do you mean? You can still stream any song with a free account. It's just that there will be ads. Additionally, in mobile apps, there will be ridiculous artificial limitations to make sure your experience is as miserable as it could possibly be.

My understanding is that the premium requirement is there to avoid having the repo taken down.

My understanding, based on a related comment in this thread, was that premium accounts get higher quality; in that case, I figured any such checks would be server-side.

If you were referring to a separate check in the above repo's code, my mistake.

Hm, maybe. I don't remember whether they offer higher quality. If they do, it would make sense to have that check on the server side. It's been a while since I last used Spotify because they deleted my account in 2022 without warning when they left Russia.

But I was referring specifically to all third-party reverse-engineered Spotify players requiring premium accounts to function at all.

You are correct

I believe that changed recently and Spotify started blocking the key requests from free accounts.

Then how do people with free accounts listen to music lol

(It is plausible they added some new DRM but it's not going to be anything too crazy)

Their official clients have moved over to playplay DRM protection for non-lossless files too. The old key endpoints no longer work for free accounts, they must have added a server-side check.