Authentication

TIDAL uses OAuth2 for authorization. After authorization (Email or 3rd-Party) the response code is then exchanged with the accessToken (authorization: Bearier xxx in Header). The accessToken is only valid for one day (sometimes 7 Days) and has to be updated.

TIDAL has also implemented a DeviceFlow for devices with limited input (like TVs or NetworkStreamer) and applications that are not web-based (reCaptcha v3 in the webflow). Here the device requests a 4 digit Authcode and a DeviceCode. The user then links the AuthCode to his account and the DeviceCode can then be exchanged for an accessToken.

DeviceFlow

1. Generate a DeviceCode and UserCode
2. Wait for the user to authenticate via link.tidal.com
3. Exchange the DeviceCode with an access_token and a refresh_token

Legacy Username&Password

1. Login
2. (Optional) Get the user_auth_token and exchange it with an access_token and refresh_token