title: Spotify node web api - trouble with multiple users
body: <p>I am working on an app that uses <a href="https://github.com/thelinmichael/spotify-web-api-node" rel="nofollow noreferrer">Spotify Node web API</a> and having trouble when multiple users login into my application. I am successfully able to go through authentication flow and get the tokens and user ID after a user logs in. I am using the <a href="https://github.com/thelinmichael/spotify-web-api-node/blob/master/examples/access-token-refresh.js" rel="nofollow noreferrer">Authorization Code</a> to authorize user (since I would like to get refresh tokens after expiration). However, the current problem is that <code>getUserPlaylists</code> function described <a href="http://michaelthelin.se/spotify-web-api-node/#getUserPlaylists" rel="nofollow noreferrer">here</a> (FYI, if the first argument is <code>undefined</code>, it will return the playlists of the authenticated user) returns playlists of the <em>most recently authenticated user</em> instead of the user currently using the app. </p>
  
  <p><strong>Example 1:</strong> if user A logins in to the application, it will get its playlists fine. If user B logins in to the application, it also sees its own playlists. BUT, if user A refreshes the page, user A sees the playlists of the user B (instead of its own, user A playlists). </p>
  
  <p><strong>Example 2:</strong> user A logs in, user B can see user A's playlists just by going to the <code>app/myplaylists</code> route.</p>
  
  <p>My guess is, the problem is with this section of the code</p>
  
  <pre><code>    spotifyApi.setAccessToken(access_token);
      spotifyApi.setRefreshToken(refresh_token);
  </code></pre>
  
  <p>The latest user tokens override whatever user was before it and hence the previous user is losing grants to do actions such as viewing its own playlists.</p>
  
  <ul>
  <li><strong>Expected behavior:</strong> user A sees own playlists after user B logs in event after refreshing the page.</li>
  <li><strong>Actual behavior:</strong> user A sees user B's playlists after user B logged in and user A refreshes the page.</li>
  </ul>
  
  <p>I am aware that I could use the tokens without using the Spotify Node API
  and just use the tokens to make requests and it should probably be fine, however, it would be great to still be able to use the Node API and to handle multiple users.</p>
  
  <p>Here is the portion of code that most likely has problems:</p>
  
  <pre><code>export const createAuthorizeURL = (
      scopes = SCOPE_LIST,
      state = 'spotify-auth'
  ) =&gt; {
      const authUrl = spotifyApi.createAuthorizeURL(scopes, state);
  
      return {
          authUrl,
          ...arguments
      };
  };
  
  export async function authorizationCodeGrant(code) {
      let params = {
          clientAppURL: `${APP_CLIENT_URL || DEV_HOST}/app`
      };
  
      try {
          const payload = await spotifyApi.authorizationCodeGrant(code);
          const { body: { expires_in, access_token, refresh_token } } = payload;
  
          spotifyApi.setAccessToken(access_token);
          spotifyApi.setRefreshToken(refresh_token);
  
          params['accessToken'] = access_token;
          params['refreshToken'] = refresh_token;
  
          return params;
      } catch (error) {
          return error;
      }
  
      return params;
  }
  
  export async function getMyPlaylists(options = {}) {
      try {
          // if undefined, should return currently authenticated user
          return await spotifyApi.getUserPlaylists(undefined, options);
      } catch (error) {
           return error;
      }
  }
  </code></pre>
  
  <p>Would appreciate any help on this. I am really excited about what I am making so it would mean a LOT if someone could help me find the issue...</p>