Last.fm API — Auth

naftiko: 1.0.0-alpha2
info:
  label: Last.fm API — Auth
  description: 'Last.fm API — Auth package. 3 operations for the desktop/web/mobile session acquisition flow (getToken, getSession, getMobileSession).'
  tags:
    - Last.fm
    - Auth
    - Music
  created: '2026-05-29'
  modified: '2026-05-29'
binds:
  - namespace: env
    keys:
      LASTFM_API_KEY: LASTFM_API_KEY
      LASTFM_SHARED_SECRET: LASTFM_SHARED_SECRET
capability:
  consumes:
    - type: http
      namespace: lastfm-auth
      baseUri: https://ws.audioscrobbler.com/2.0
      description: Last.fm authentication flow capability.
      resources:
        - name: auth-gettoken
          path: /
          operations:
            - name: authGetToken
              method: GET
              description: Get an unauthorized request token (step 1 of web/desktop flow).
              outputRawFormat: json
              inputParameters:
                - { name: method, in: query, type: string, value: auth.getToken }
                - { name: api_key, in: query, type: string }
                - { name: format, in: query, type: string, value: json }
              outputParameters:
                - { name: token, type: string, value: $.token }
        - name: auth-getsession
          path: /
          operations:
            - name: authGetSession
              method: GET
              description: Exchange an authorized token for a session key.
              outputRawFormat: json
              inputParameters:
                - { name: method, in: query, type: string, value: auth.getSession }
                - { name: api_key, in: query, type: string }
                - { name: format, in: query, type: string, value: json }
                - { name: token, in: query, type: string }
                - { name: api_sig, in: query, type: string }
              outputParameters:
                - { name: result, type: object, value: $.session }
        - name: auth-getmobilesession
          path: /
          operations:
            - name: authGetMobileSession
              method: POST
              description: Direct username/password session acquisition for mobile devices.
              outputRawFormat: json
              inputParameters:
                - { name: method, in: formData, type: string, value: auth.getMobileSession }
                - { name: api_key, in: formData, type: string }
                - { name: username, in: formData, type: string }
                - { name: password, in: formData, type: string }
                - { name: api_sig, in: formData, type: string }
              outputParameters:
                - { name: result, type: object, value: $.session }