Upcoming changes to user accounts and authentication

We are in the process of moving  user accounts, authentication and OAuth applications from the MusicBrainz website to the MetaBrainz website.
This centralizes our account management between all the *Brainz projects, along with some security improvements.

Historically, all accounts were managed on the MusicBrainz website simply because it existed before the MetaBrainz Foundation itself. However, creating a MusicBrainz account just to use ListenBrainz or our other sister projects doesn’t make much sense.
We are changing this legacy setup to improve the user experience and bring better cohesion to the entire MetaBrainz ecosystem.

Here is what you need to know about how this transition affects you:

Changes for users

If you use MusicBrainz, ListenBrainz, BookBrainz or any other *Brainz project, most of your experience won’t change. However, note the following updates:

• Account login/creation: When logging in or creating a new account, you will be redirected to the MetaBrainz website to complete the process.
• Login page localization: We are currently translating the new login pages. Your preferred language might not be fully available yet while this work is in progress. If you can help with translation, please head over to our translation platform.
• Digest authentication in the web service (API) is deprecated:
  • Existing users: If you already use digest authentication, it will continue to work normally for the time being, using whatever account password you had at the time of the migration.
  • Password changes: If you update your account password, the new password cannot be used for digest authentication. (The old password will continue to work until you generate a token; see below.)
  • Digest authentication tokens: We’re adding support for tokens which can be generated from the Applications page. The token should be used in place of your account password in applications that ask for it. As a user, it’s strongly recommended that you generate a token if you’re currently providing your account password to an application.
  • New users: Digest authentication is disabled by default. New users must generate a digest authentication token from the Applications page.

Changes for developers

If you maintain an application or script that integrates with MusicBrainz, you will need to update your authentication flow:

• OAuth applications: the OAuth applications page will move to the MetaBrainz website after the migration: https://metabrainz.org/profile/applications
• New auth URLs: The endpoints for authentication are migrated as well. You will need to update these base URLs in your code: https://musicbrainz.org/oauth2/... –> https://metabrainz.org/oauth2/...
• Existing OAuth applications currently set up on musicbrainz.org are deprecated. They will continue to work through the https://musicbrainz.org/oauth2/ endpoint for the time being, but will not be migrated to MetaBrainz OAuth. New applications must be created on MetaBrainz.
• Mandatory PKCE: Proof Key for Code Exchange (PKCE) is now mandatory for all OAuth flows to ensure better security.
• Drop digest auth: Move your applications from legacy digest authentication to OAuth. As a transitional measure, you can inform your users about generating a digest auth token.

⚠️ Note on DIGEST Auth TOKENS

While MusicBrainz digest authentication tokens will be supported as a transitional measure, they will be removed in the future. OAuth is strongly preferred and recommended for all applications.

Timeline

• Monday July 6th: account migration (Update: The migration timeline has been moved to July 20th)
  • We will have a short downtime for all MetaBrainz services while we transfer user accounts
• July 1st 2027: 1 year after the migration, digest authentication and MusicBrainz Oauth apps will be removed
  • The deprecated digest authentication will be retired and this authentication flow will stop working. Please migrate your applications to use OAuth.
  • Existing OAuth applications created on MusicBrainz will stop working. Please create a new OAuth application on MetaBrainz

If you run into issues or have questions, do let us know on the community forums or reach out on Matrix/Discord/IRC.