I am trying to create a small app that will use the Spotify API. Because it’s meant to be small I don’t really want to add any authentication on my end but I still would like to have “sessions”.

My current ideia was to, after the OAuth2.0 is done with Spotify, simply store the userID alongside the access and refresh token and use cookie sessions (encrypted) with said userID. However this feels kind of funny, isn’t this misusing OAuth2.0? It seems I am trying to use OAuth2.0 for auth, kind of like OIDC. Is this approach acceptable or is there a better way of handling this?

I was also wondering how could I use the “state” parameter if I don’t really have performed any authentication before the flow is completed. Should I also be creating a session before the user enters the OAuth2.0 flow and checking it at the end? I think I might also be misunderstanding the “state” parameter usefulness.