Feature Request > Allow Credentials to be pushed in through deep url

[noah1234j]

Support query parameters on the existing substreamer:// scheme to pre-fill the login screen:

Something like
substreamer://login?server=https%3A%2F%2Fmyserver.example.com&user=noah&password=hunter2

This way we could push users preauthed into your amazing app!

[ghenry22]

Are there other apps that do this? Could you share some examples and maybe talk me through how you would use this with a real example?

Substreamer, as it’s an app, is really designed to be single user at a time, if I understand better what you are trying to do I can think about whether it would work.

We already enable sharing of your server supports it so you can for example share a playlist or album, it creates a share on your server and gives you a link you can give to anyone.

An interesting idea would be to make shares available within the app rather than the server website but that would be really dependent on how the server builds its share pages, whether they are machine readable etc might be a bit flaky as there isn’t a proper API for it so we would be working around the sides.

[noah1234j]

Thanks for your quick response! Our use case is we host a website for our church of about 1k people, and produce in-house music which we host from a private Subsonic-style server. Right now, we provide instructions once the user logs in on our site to log into our Subsonic server using their own credentials. We have a download link to the app and setup instructions.

It would just be a bit more user-friendly for the technology-challenged ones if we could push them to the app with their credentials already in place. We can already have a web link that pushes them to the app with substreamer:// etc but if we could push in their credentials from the web app would be even better.

Let me dig around a big, and try to find some examples for you.

[noah1234j]

I found an example in Nextcloud, they allow deep links through url strings such as

nc://login/server:https://cloud.example.com&user:noah&password:secret

The relevant file is here
It shows how they parse the url into a login, although ours would look a bit different as its not android native.

Heres what it might look like in your app.
in src/screens/login.tsx

We would pull in url and use the params something like this maybe?

import { useURL } from 'expo-linking';
import * as Linking from 'expo-linking';

const incomingUrl = useURL();
const params = incomingUrl ? Linking.parse(incomingUrl).queryParams : null;

const [serverUrl, setServerUrl] = useState((params?.server   as string) ?? '');
const [username,  setUsername]  = useState((params?.username as string) ?? '');
const [password,  setPassword]  = useState((params?.password as string) ?? '');

That way they autofill if a deep url and remain blank if not.

[noah1234j]

if clear text pw is a concern in the url chain, then we could also push this through using a salt auth as provided by subsonic, that would be even better. But you would have to build int that token login capability in the app.

const incomingUrl = useURL();
const params = incomingUrl ? Linking.parse(incomingUrl).queryParams : null;

const [serverUrl, setServerUrl] = useState((params?.server   as string) ?? '');
const [username,  setUsername]  = useState((params?.username as string) ?? '');

const deepLinkToken = (params?.token as string) ?? null;
const deepLinkSalt  = (params?.salt  as string) ?? null;

if (!pass && deepLinkToken && deepLinkSalt) {
  setLoading(true);
  const result = await subsonicLoginWithToken(url, user, deepLinkToken, deepLinkSalt);
  // same success/error handling as the existing block
  return;
}

src/services/subsonicService.ts

export async function subsonicLoginWithToken(
  serverUrl: string, username: string, token: string, salt: string
) {
  // Same as login() but passes t= and s= instead of p=
  const url = `${serverUrl}/rest/ping?u=${username}&t=${token}&s=${salt}&v=1.16.0&c=substreamer&f=json`;
  const res  = await fetch(url);
  const json = await res.json();
  return json['subsonic-response'].status === 'ok'
    ? { success: true }
    : { success: false, error: json['subsonic-response'].error?.message };
}

you should theoretically then be able to pass in the token rather than pw in cleartext from web apps.
substreamer://login?server=yourserverurl&username=john&token=abc123&salt=xyz789

thinking about this, would be even better if it logged us in as well rather than just passing the credentials into the ui. Lmk you would consider this feature, and I can pull the code and get some working examples for you.

[noah1234j]

Either way its a great app. Love the work your doing!

[ghenry22]

Ok my question is more how does this work for users rather than how do I technically implement it. I already have full support for deeplinking into the app.

You have to remember that nextcloud is primarily a web based collab platform whereas we are a native mobile music player app. We are single user by nature (as you don't usually pass your phone to someone else to then login to an app).

So what is the actual USER facing flow here and the benefit?

1. I hit the share button on something
2. in the native share dialog I send it to you
3. you tap on the link and it opens substreamer on YOUR phone and displays the shared content so you can listen to it

Is this what you are thinking?

We do have support for subsonic API native sharing doing exactly this BUT the exception is that the link opens in the web browser rather than in the app as subsonic share links are designed to be served directly from the server not within client apps. The API provides no way to show a list "shared with me" for example. I could build this functionality and if this is the use case I think it's cool (similar to plex library share type thing).

If you were thinking of something else give me a similar step by step from the users perspective of your idea.

[noah1234j]

Ah my apologies,

The benefits would be for organizations, and would simplify onboarding of new users and or new devices. Admins can quickly share qr codes or links for easy first time login / new devices login rather than sending settup instructions to non technical users.

Log into user portal >
Web app generates unique link for login after creating backend user on server >
Click it and authenticate

Or

Admin creates new server user > sends non technical user url or qr.

Workflow from an end users perspective would be similarish to nextcloud:

Web portal creates app-specific login token/password → shows QR code → mobile app scans it → app is configured.

Also some similar workflow examples in jellyfin quick connect, plex device linking, emby connect.

Hope this helps

[ghenry22]

ok that makes it a bit clearer. Are you planning to use substreamer in an organization? It was never really my target audience but if you are it would be super cool to hear about it and support the use case.