If downloading for a song is disabled, can a 3rd party application that has been authenticated still use the download URL to grab the track?

Question

I'm trying to create an application using Ruby on Rails that allows a user to download all of the songs that they have uploaded. At this point I've authenticated the user using OmniAuth, and I've managed to pull some data using Soundcloud's Ruby interface with their API.

According to the API, every track has an associated title, artwork_url, and download_url (I have already used the API to get this information). I'd like to display each song showing its title and artwork (if any exists), and then if they choose to download that track, they'll be able to click a button and download that track from the download_url.

So here's what I've realized: for most tracks (or sounds, as they are called in Soundcloud), downloading is disabled by default when you upload it. The thing is, there is also an option that says "Apps Enabled/Disabled." What I'm wondering is if downloading for a song is disabled, can a 3rd party application that has been authenticated still use the download URL to grab the track? I'd like to know if users will need to individually go through all their tracks and enable downloading in order for this to work.

If you need any more detail, please say so. Apologies if this is an obvious question.

Thanks,

Nat

Answer 1

What I'm wondering is if downloading for a song is disabled, can a 3rd party application that has been authenticated still use the download URL to grab the track?

Yes, it can. However, note that in order for API to actually serve the file, there has to be an HTTP Authorisation header and client_id GET parameter.

This means that simply spitting out the links like

<a href="https://api.soundcloud.com/tracks/{id}/download">Download {title}</a>

will not help. As for client_id, you could simply append it to the href, but since browser doesn't know about the fact that your app has been authorised and can't send HTTP headers with simple requests, API won't let the user download tracks that are not publicly downloadable.

Because of that, you'll need to build a proxy in ruby and set hrefs to your local endpoints and handle the connection to the SoundCloud API on the ruby side, so you can pass HTTP header with OAuth token.