diff --git a/auth.php b/auth.php
index 61585234..d93c5ecc 100755
--- a/auth.php
+++ b/auth.php
@@ -3,18 +3,18 @@
 // allow cross-domain requests
 header("Access-Control-Allow-Origin: *");
 
-$url = 'http://jamesbarnsley.co.nz/auth.php';
+$url = 'https://jamesbarnsley.co.nz/auth.php';
 
-if( isset($_GET['app']) )
+if (isset($_GET['app'])){
 	setcookie( 'mopidy_iris', $_GET['app'], time()+3600 );
-
+}
 
 
 /* ================================================================================= INIT ================ */
 /* ======================================================================================================= */
 
 // we've just completed authorization, now create credentials (access_token, etc)
-if( isset($_GET['code']) ){
+if (isset($_GET['code'])){
 	
 	// go get our credentials
 	$response = getToken( $_GET['code'], $url );	
@@ -30,7 +30,7 @@ if( isset($_GET['code']) ){
 		die();
 	}
 	
-	// send our data back to Spotmop
+	// send our data back to Iris
 	?>	
 		<script type="text/javascript">
 			window.opener.postMessage( '<?php echo $response ?>', "*");
@@ -38,8 +38,19 @@ if( isset($_GET['code']) ){
 		</script>
 	<?php
 
+// authorization error
+} else if (isset($_GET['error'])){
+
+        // Pass our error back to Iris
+        ?>
+                <script type="text/javascript">
+                        window.opener.postMessage("{\"error\": \"<?php echo $_GET['error'] ?>\"}", "*");
+                        window.close();
+                </script>
+        <?php
+
 // refresh existing token
-}else if( isset($_GET['action']) && $_GET['action'] == 'refresh' && $_GET['refresh_token'] ){
+} else if (isset($_GET['action']) && $_GET['action'] == 'refresh' && $_GET['refresh_token']){
 	header('Content-Type: application/json');
 	$response = refreshToken( $_GET['refresh_token'] );
 	
@@ -51,7 +62,7 @@ if( isset($_GET['code']) ){
 	die();
 
 // fresh authentication, so let's get one
-}else if( isset($_GET['action']) && $_GET['action'] == 'authorize' ){
+} else if (isset($_GET['action']) && $_GET['action'] == 'authorize'){
 	getAuthorizationCode( $url );
 }
 
@@ -73,8 +84,8 @@ if( isset($_GET['code']) ){
 */
 function getAuthorizationCode( $url ){
 
-	$popup = 'https://accounts.spotify.com/authorize?client_id=01d4ca2e9f4f415c80502431a6aa4200&redirect_uri='.$url.'&scope=playlist-modify-private%20playlist-modify-public%20playlist-read-private%20playlist-modify-private%20user-library-read%20user-library-modify%20user-follow-modify%20user-follow-read%20user-top-read&response_type=code&show_dialog=true';
-	
+	$popup = 'https://accounts.spotify.com/authorize?client_id=01d4ca2e9f4f415c80502431a6aa4200&redirect_uri='.$url.'&scope=playlist-modify-private%20playlist-modify-public%20playlist-read-private%20playlist-modify-private%20user-library-read%20user-library-modify%20user-follow-modify%20user-follow-read%20user-top-read%20user-read-currently-playing%20user-read-playback-state&response_type=code&show_dialog=true';
+
 	?>
 		<script tye="text/javascript">
 		
@@ -199,3 +210,4 @@ function refreshToken($refresh_token){
 
 
 
+
diff --git a/src/js/components/SpotifyAuthenticationFrame.js b/src/js/components/SpotifyAuthenticationFrame.js
index 85f692c8..b7a00447 100755
--- a/src/js/components/SpotifyAuthenticationFrame.js
+++ b/src/js/components/SpotifyAuthenticationFrame.js
@@ -30,27 +30,45 @@ class SpotifyAuthenticationFrame extends React.Component{
 		// this is triggered when authentication is granted from the popup
 		window.addEventListener('message', function(event){
 			
-			if(event.data == 'closed'){
+			// Window prematurely closed
+			if (event.data == 'closed'){
+				self.setState({
+					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
+					authorizing: false
+				})
+
+			// Popup was blocked by the browser
+			} else if (event.data == 'blocked'){
+				self.props.uiActions.createNotification('Popup blocked. Please allow popups and try again.','bad')
+				self.setState({
+					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
+					authorizing: false
+				})
+
+			} else {
+				
+				// only allow incoming data from our authorized authenticator proxy
+				if (!/^https?:\/\/jamesbarnsley\.co\.nz/.test(event.origin)){
+					return false
+				}
+
+				var data = JSON.parse(event.data);
+
+				// Spotify bounced with an error
+				if (typeof(data.error) !== 'undefined'){
+					self.props.uiActions.createNotification(data.error,'bad')
+
+				// No errors? We're in!
+				} else {
+					self.props.spotifyActions.authorizationGranted(data);
+					self.props.spotifyActions.getMe();			
+				}
+
+				// Turn off our authorizing switch
 				self.setState({
 					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
 					authorizing: false
 				})	
-			}else if(event.data == 'blocked'){
-				self.props.uiActions.createNotification('Popup blocked. Please allow popups and try again.','bad')
-			}else{
-				
-				// only allow incoming data from our authorized authenticator proxy
-				if( !/^https?:\/\/jamesbarnsley\.co\.nz/.test(event.origin) ) return false;
-				
-				var data = JSON.parse(event.data);
-				self.props.spotifyActions.authorizationGranted( data );
-				self.props.spotifyActions.getMe();
-
-				// and turn off our authorizing switch
-				self.setState({
-					frameUrl: 'https://jamesbarnsley.co.nz/auth.php?action=frame',
-					authorizing: false
-				})				
 			}
 
 		}, false);