Instafeed.js: New Instagram API restrictions & how it affects Instafeed.js

[goldprismco]

UPDATE (@stevenschobert): This thread has turned into a conversation about how Instafeed.js is going to work with Instagram's new API restrictions.

Currently, new Instagram API clients are not able to fetch much of the data that Instafeed.js relied on to work, and we are evaluating options for how to handle authentication going forward. Credentials created before the API restrictions went live are not affected for now.

---

Original Post:
I'm working on a client project (built on Shopify platform) and am looking to pull in their Instagram posts by user. I have it all setup - but it will not pull in my client's account. When I plug in my personal Instagram account userId & clientId, everything works perfect so I know it's not an issue with how I have it set up. Are there any known security settings that will prevent instafeed from working on a specific account? To note, the account I'm looking to pull in has a very large following.. not sure if that has anything to do with it?

Here's the set-up I have for reference (includes liquid language as used on Shopify, so just ignore that):

{% assign instafeed_img = '{{image}}' %}
{% assign instafeed_link = '{{link}}' %}
{% assign instafeed_likes = '{{likes}}' %}
{{ 'instafeed.min.js' | asset_url | script_tag }}
<script type="text/javascript">

var userFeed = new Instafeed({
    target: 'instafeed',
    get: 'user',
    userId: '260149935',
    clientId: 'xxx',
    limit: '10',
    sortBy: 'most-recent',
    resolution: 'standard_resolution',
  template: '<div class="grid__item large--one-fifth"><a href="{{ instafeed_link }}" target="_blank"><img src="{{ instafeed_img }}"><span class="likes"><span class="icon icon-heart" aria-hidden="true"></span>{{ instafeed_likes }}</span></a></div>'
});
userFeed.run();
</script>

[goldprismco]

UPDATE! Not sure why but with my client's account userId & clientId I'm getting an error: "The access_token provided is invalid". There's no access_token provided in the script, or course, as it was noted that with the recent version of instafeed this is no longer required. This error does NOT come up when I have my personal Instagram userId & clientId plugged in (and the script works and pulls in my user feed).

Thanks in advance for any insight you can provide on why this is happening & how to fix.

[123ndy]

I am also having this problem (with plain js). When I create a new Instagram client and provide the CLIENT_ID into instafeed, I get "The access_token provided is invalid". When I use a random CLIENT_ID I found on some forum, it works. I have tried with two different CLIENT_IDs I found on some forums and they both work, but none of mine newly created CLIENT_IDs work?

[stevenschobert]

This is most likely due to the new API restrictions Instagram rolled out this week:
http://instagram.com/developer/changelog/

Have either of you tried to submit your new client apps to the review process?

[123ndy]

That would explain it. I will get the client app reviewed, and report back.

[stevenschobert]

@goldprismco @123ndy Just a quick update:

I tried creating a new Instagram client ID and received this same error. I'm currently waiting to submit a test application through their review process. I'm hoping they will accept it under the "share my own content" use case, but we'll have to see!

Sorry for the inconvenience folks, I wish there was something more I could do :disappointed:

[123ndy]

Seems we have to wait untill Dec 3, 2015 before they start to accept Permissions Review submissions.

[goldprismco]

@stevenschobert thanks for looking into it! Would using the access token fix this in the interim?

[stevenschobert]

@goldprismco If the token was generated before the API restrictions went into place, then it might. The same goes for client IDs.

My current understanding is that all _new_ API credentials (including both access tokens and the client IDs they belong to) are now stuck in sandbox mode until the review process opens up.

[iljapanic]

I'm having the same issue. Token from the old API works without any issues, however the newly generated tokens don't work.

Any suggestions on how to go about solving this?

[123ndy]

@iljapanic I think we just have to wait until Dec 3 when they start to accept Permissions Review submissions.

[egardner]

I'm experiencing the same issue as well. Hoping that the Instagram API changes don't make it impossible to continue using the script in this fashion.

[bakura10]

Ouch, that sounds like a major pain change from Instagram. We were using that for Shopify too, where customers can simply enter their client ID, but I started to receive mails from people saying it does not work.

If we now must explain them that they should submit their app and wait, it will definitely be very annoying. Did anyone try if the access token suffers from the same issue?

[bakura10]

It seems though that access token retrieved from the Instafeed client (https://instagram.com/oauth/authorize/?client_id=467ede5a6b9b48ae8e03f4e2582aeeb3&redirect_uri=http://instafeedjs.com&response_type=token) properly returns an access token that seems to work (at least that's how we recommend our theme customers to get their token and so far I didn't receive any email saying that it does not work). Asking our customers to create a client, asking permissions, justifying permissions, waiting... does not seem possible tbh.

So maybe Instafeed may make sure that their client used to generate those tokens is properly being reviewed so that it can continues generate token in the future?

[stevenschobert]

Update: I submitted an application for review to Instagram earlier today, and am waiting to hear back.

I did discover that sandboxed clients can still access limited user information (if the user has been invited to the sandbox app), but only through access tokens, and only the last 20 pictures. This in theory would allow Instafeed.js to continue, but severely limits its usefulness :(

Hoping for the best everyone! Please accept my apologies, I wish there was more I could do to change the situation!

[stevenschobert]

@bakura10 Yeah, that would make sense because that client (the one for the Instafeed.js website) was created long before these restrictions were in place. So its only going to continue working until they enforce the permissions on the legacy clients as well.

[stevenschobert]

I'm going to update the title and original post of this thread, so it more accurately reflects the current situation

[bakura10]

Haha nice to hear, let us know, I hope Instagram will accept your app so I can still route our users to your website to generate an access token. Otherwise, I already feel the pain of hundreds of our theme users filling our support queue with "Instagram is not working anymore" :o.

[bakura10]

Also, in order to avoid you to have also a lot of issues, I think (unfortunately) that you should revert back your documentation to recommend using access token instead of client ID, and re-integrate your link to generate access token (I was unable to find it in your current page).

[shc023]

I also ran into this today, and while going through the process I noticed a "required step" to get approved is to "Provide a link to a video screencast showing a working Instagram Login experience in your app, as well as the usage of every permission you are requesting." and I feel that this is simply not meant for individuals to use.
It seems that Instagram API now only wants to allow Platform developers to continue to use the API, instead of individual websites all implementing the API on their own. Instagram should seriously consider at least allowing the public_content scope to be retrieved without access_token, or it'll screw over every website out there that uses client-side instagram feeds.

[netgfx]

Agreed with the above post

[manatarms]

I submitted my app after the new review process went into place. All I want to do is display my images on my wesite. I asked for basic permission but got an Invalid use case issue in the review feedback not sure what that means.
Instafeed is throwing an error for client not approved but for some reason Instagram allowed me to go live. So I'm not really sure whats happening and how to proceed.

Any help is much appreciated.
Thanks

[manatarms]

Hey everyone,
Not sure what changed but it's suddenly working again. My issue seems to have fixed itself. I will try and see what changed so I can give you'll some feedback

[themechills]

@manatarms when going through the review process, did you have to provide a link to a video screencast (screenshot below)?

[manatarms]

@themechills I just put in a link to the section showing the implemetation. Didnt really make a video screencast.

[themechills]

@themechills I just put in a link to the section showing the implemetation. Didnt really make a video screencast.

Thanks for the clarification buddy

[ImTylerPorter]

First off, thank you for a great script!

As I created my app with Instagram before their new API release, I wanted to be sure my service was uninterrupted. Placed a submission for review and was denied. All my site does is pull content from my personal Instagram feed. Curious to see how this will turn out for more instafeed.js users in the days to come.

For the future, any tips to get a passing submission would be greatly appreciated.

[Valentine-Mick]

Hi there,
I've just started deving up my first new new project with a personal Instagram feed to a website since this API change has been implemented.

I've always used instafeed and sailed through now this is really irritating with the whole access token being denied.

Can I please request the final methods to those who managed to getting working? Did you have to take it out of sandbox mode for it to work even while testing etc? I hate to be pesky but until a clearer documentation I'm a little uncertain how to get a feed for testing and then for public.

Cheers

[benrlodge]

There seems to be a little confusion on this thread -

As mentioned in the instagram change log (and here https://github.com/stevenschobert/instafeed.js/issues/364), Apps created on or after Nov 17, 2015 (though they have a typo saying 2005...fail) require a valid access_token.

So technically if you can get your hands on the access_token, you can still use instafeed, but, you shouldn't. (Note - I wrote up a quick blog post on how to get an access token http://www.benrlodge.com/blog/post/how-to-generate-an-instagram-access-token)

As stated at https://www.instagram.com/developer/authentication

The Instagram API requires authentication - specifically requests made on behalf of a user. Authenticated requests require an access_token. These tokens are unique to a user and should be stored securely. Access tokens may expire at any time in the future.

So you can still access the instagram API if you can get an access_token, but you should be using it on the server-side where your access_token can't be read, not on the client-side, i.e. you shouldn't use your access_token with instafeed.js. Sorry, major bummer, I know!

If you have access to server-side code, you can just write your own custom request, but I'm afraid cool tools like instafeed.js that rely on the client-side are not going to be an option moving forward.

Long story short - Instagram is trying to get a much tighter grip on their API, and it's not going to offer the free-wheelin access it used to. http://mashable.com/2015/11/19/instagram-third-party-apps/#.L.TZRd8I5q0

[Valentine-Mick]

@benrlodge thanks for the clear up. What a bummer!

[sfrdmn]

@benrlodge Not quite true. It's the client_secret which should absolutely never be exposed to clients, not the access_token. Access tokens are tied to single users, after all. If the either the server or the client has access to the access_token, the only person it can abuse is the user him/herself (who unfortunately granted permission)

Instagram even explicitly provides a means of fetching access tokens from the client: Client Side (Implicit) Authentication

At the end of the day, whether you handle auth on the server or client, you'll still need an Instagram client to fetch that data, e.g. instafeed. instafeed could easily support both the case where it has the access token, and where it doesn't. For the latter it would just need a configurable endpoint which acts as a proxy to Instagram

Edit: It should be noted that rate limits apply _per_ access token, not per app

Edit edit: OK well, I guess you can still get your app disabled for being spammy, but can be a caveat in the Readme for people using client side auth

[lusa]

Talking more about @sfrdmn's comment - "configurable endpoint which acts as a proxy to Instagram". So if all our app requires is public_scope (IE a random user's feed), can't we just create an endpoint with someone's access_token and then return any user's public feed from that endpoint?

Can someone just build a third party service to do this for public_scope data? That way we just make an ajax request, and the service returns our publically available data for us. Aka, A PUBLIC API. This really makes no sense that this is closed off.

Edit: According to several articles "any app that pulls in a full Instagram feed will be axed by the new restrictions". If this is true then I don't know why Instagram is providing this user endpoint at all.
http://www.theverge.com/2015/11/17/9751574/instagram-app-developers-api-restrictions-security-privacy

[jscissr]

@lusa I guess the problem with building a "third party service" with a single access_token is rate limits. You would have to use caching and obtain multiple access_tokens, i.e. from every developer using the API. And then you would have to get that service approved by Instagram.

The only other option I can think of is using sandboxed mode, with all its limitations, and with the caveat that access_tokens may expire.

For now, I'm considering simply scraping Instagram's website on my server, caching the result for 30 minutes, and hoping it doesn't get blocked. Because that is actually the public API that we want. :wink:

[sfrdmn]

@lusa AFAIK, the API doesn't allow fetching random feeds at all. It only allows fetching the feeds of users who have explicitly given your app permission. I don't think it would be possible to fetch data for multiple users over a single access token. You can: have clients make requests via a server proxy where the server knows how to correlate clients to access tokens, have clients request access tokens from the server proxy and from there on do whatever, or use Instagram's client auth flow and ignore all that but create potential security issues

Sandbox mode doesn't change any of that, all it does is restrict the users from whom you can grab feeds and lowers the rate limit
_(woops, not sure that was right. ignore :) )_

Nvm, I see what you mean now. I guess it just depends on how you want to implement your app/endpoint

[mgrn0]

Did anyone get a "just show my instagram feed on my website" permission inquiry approved so far?

[mgrn0]

I submitted my "web app" for approval yesterday, it is "just" a website showing a client's instagram feed and got denied..

Is there _any_ way to get this solved? I am really fed up with Instagram for this new API rules, I _just_ want to show a feed on a webpage, nothing else!

[jscissr]

@mgrn0 I think you don't need public_content for your use case, basic is enough. However I don't know if that is the only problem.

[mgrn0]

Am I wrong - if I want to fetch somebody elses feed, I thought I would need public_content ?

basic - to read a user’s profile info and media (granted by default)
public_content - to read any public profile info and media on a user’s behalf

-> https://www.instagram.com/developer/authorization/#alerts

I _could_ ask the client to give me his login credentials once (he is technically not really skilled) to create the token but that is far from ideal..

[jscissr]

Yes, I thought you would use an access_token from your client. I understand that you want to use a different account, but maybe Instagram doesn't.

[cshold]

My app was also denied as being a simple gallery on an "About Us" page doesn't fit one of their valid uses cases:

1. to help individuals share their own content with 3rd party apps
2. to help brands and advertisers understand and manage their audience and digital media rights
3. to help broadcasters and publishers discover content, get digital rights to media, and share media with proper attribution

Seems like they don't want anyone creating Instagram galleries on external websites.

[mgrn0]

Anyone successful? Is there really nobody out there trying to set up an instagram gallery web-app?

[joeblackburn]

I had a 5 picture feed on a website get rejected for the same "Invalid Use Case". The traffic on the site is small enough that I'm going to try and use it in the sandbox mode and see if the rate limit is an issue.

[mgrn0]

The sad part of the whole situation is that a scraper is written in less then 1 hour and this kind of restrictions undermine _any_ good will to use a proper API..

(I am not saying that anyone should write or use a scraper. I just think that Instagram's approach is way too strict and not a good one)

[baptistebriel]

I came across the same issue; I just wanted a GET response of the latest posts of a user.
I had to specify the accessToken as well as the clientId.

All you have to do is enter the URL with the client_id from your app and the redirected_url:
https://api.instagram.com/oauth/authorize/?client_id=CLIENT-ID&redirect_uri=REDIRECT-URI&response_type=token

You'll get the access_token at the end of the URL and everything should be working fine.

[mgrn0]

that's all working, but did you get the app reviewed AND approved? It's easy to get it working in sandbox mode, but I did never succeed with the new review process.

[baptistebriel]

Wow? We still need to look into that and do the whole process. I'm still using the sandbox version.
But does that means it's currently NOT possible to use Instafeed.js with an approved app?
Will get back here if we I have any news on my side. Thank you, @mgrn0

[bakura10]

For now it seems that retrieving the access token from Instafeed still works.

From what I understand, it is actually Instafeed that must manage to make their app to be accepted. If that works, then we can still use Instafeed to get our access token.

But I may be wrong? In all cases, Instagram sucks on this thing...

Envoyé de mon iPhone

Le 11 janv. 2016 à 19:15, Baptiste Briel [email protected] a écrit :

Wow? We still need to look into that and do the whole process. I'm still using the sandbox version.
But does that means it's currently NOT possible to use Instafeed.js with an approved app?
Will get back here if we I have any news on my side. Thank you, @mgrn0

—
Reply to this email directly or view it on GitHub.

[mgrn0]

As far as I understood we all have to get our own access tokens and instafeed is just the tool, so everybody would have to get his own app/website/gallery (with or without using instafeed, does not matter) approved by Instagram.

Or am I wrong?

[bakura10]

I think you're wrong. It seems that all the apps just to get an access token are rejected by Instagram. But if Instafeed client alone managed to be accepted, then this one will be able to generate access token for our own accounts.

Envoyé de mon iPhone

Le 11 janv. 2016 à 19:42, mfruehman [email protected] a écrit :

As far as I understood we all have to get our own access tokens and instafeed is just the tool, so everybody would have to get his own app/website/gallery (with or without using instafeed, does not matter) approved by Instagram.

Or am I wrong?

—
Reply to this email directly or view it on GitHub.

[kokarn]

No, every single developer needs an approved app on Instagram for this to work outside of sandbox.

[mgrn0]

Thanks @kokarn, just what I suspected (unfortunately).

[rafasegat]

Did someone get an app approved with public_content permission?

Fuck! I dont know what to do anymore..

Thanks

[rickydazla]

@cshold wrote a nice piece on this: Instagram API Limits Valid Use Cases

The key is in the language bolded and _emphasized_ in that article and below:

• to help individuals _share their own content with 3rd party apps_
• to help brands and advertisers _understand and manage their audience and digital media rights_
• to help broadcasters and publishers _discover content, get digital rights to media, and share media with proper attribution_

Although it sucks, I think it makes sense to a certain degree... As a small business should you really be allowed to parse all public_content and display a hashtag stream on your site because you have decided you own that particular #insertphrase? That's what many are doing with tools like this, myself included.

As a sandboxed app you _can_ access _some_ of your own media...

[stevenschobert]

Hey everyone! Sorry this issue has drug out for a while. I've been pretty bummed about the new restrictions and felt pretty powerless to change anything.

I did try to create a sample app and submit it through Instagram's review but, like everyone else, it got rejected.

Short of making a dedicated server to maintain tokens and proxy requests for everyone, I'm not sure what do to. Does anyone have contacts at Instagram that I could ask questions to? If so please shoot me an email.

I did get the project to work successfully in sandbox mode, so we could always update instructions to point out how to do that. But would that even be useful to anyone, given the restrictions they have on sandboxes apps?

Feedback would be greatly appreciated!

[stevenschobert]

@rickydazla I'm not disagreeing with the restrictions, or saying that they aren't logical.

Instagram has tons of incentives to keep users coming back to their 1st party applications, so they can create great browsing experiences, etc. One way to guarantee that is to restrict 3rd parties that are outside of their control.

I do think that restricting 3rd parties isn't the _only_ way to accomplish that (Instagram could, and has been, making great experiences while still allowing 3rd parties to exist for a long time), but I can see how they don't stand much to gain much from allowing it.

Regardless of how much sense it makes for Instagram or not, it's disappointing for everyone who relied on Instagram's API for some part of their product/projects.

[rickydazla]

@stevenschobert my comments only really apply to public_content — essentially prohibiting access to one's own content (for individuals or otherwise) is pretty ridiculous

[stevenschobert]

@rickydazla Yeah, the restrictions really are on the tight side. Even in sandbox mode, you can only access 20 of your most recent pictures, correct?

I'm curious how successful other 3rd parties have been in getting approved. Apps that try to cover other use cases, or do more than just pull in public content.

[mgrn0]

I found a jQuery plugin (commercial) and they state that they got approved (https://elfsight.com/blog/2015/11/no-more-need-in-instagram-client-id-after-november-17-2015/) but as far as I find out they provide a proxy for all their clients that acts as the "app" that was approved, so that is not really a solution to the problem. It's interesting that their "app" git approved (as stated here: http://codecanyon.net/item/jquery-instagram-plugin-instalink/10585662 - "instagram api changes from nov 17th are allready supported"), though since customers can filter and pull all kinds of feeds (all public coontent).
(I don't want to solicit their product, for me it is useless)

Their "apps" don't do anything different than all the people that tried to get new apps approved using instafeed...

[jscissr]

This is interesting, the page on elfsight where you can get an access_token is public, and the access token you get seems to work for public_content.
To try it out, generate a token and then paste it into this url:

https://api.instagram.com/v1/tags/nofilter/media/recent?access_token=ACCESS_TOKEN

[mgrn0]

You are right, it really works for public content, too. I wonder how (and if) Instagram will shut down single access tokens that are connected to this app?

[mayramoca]

So do we have steps to follow so that this app works? I thought I was going crazy I managed to get a code and then have no idea how to get the access token.?

[manatarms]

@mayramoca You can use the this link http://jelled.com/instagram/access-token to get your access token. I managed to get the app working by passing the client id, userid and the access token to the plugin.

[mayramoca]

@manatarms like this am I doing something wrong?

[manatarms]

@mayramoca I suggest you remove your keys. It's not a good idea to post them online. Your code seems ok. If it isn't working check the browser console and see if the API is returning any errors. What is the error you're getting?

[mayramoca]

@manatarms Thank you I got this this worked I had one small thing wrong on my end but i fixed it and it worked great thank you soooo much for your time :)

[manatarms]

@mayramoca You're welcome.Glad you got it working.

[Ewster]

@jscissr that works for me, super thanks. hope it stays working for a while :)

[callamwilliams]

So, correct me if I'm wrong, trying to collate all the info. This means we now have to get every single web based Instagram feed approved by Instagram themselves? We've been waiting 1/2 a day for a response to go live already.

If I'm creating a feed for the client from their own images, where all of the API calls are done in PHP I shouldn't have a problem?

Is there a way to have one cover all app that gets approved to fetch feeds, and then have clients go in and approve access for this app themselves? We can't really afford to be waiting around for approval each time in an agency environment.

Can't say the documentation is particularly well laid out. You'd think for a change like this there would be a quick FAQ put together...

[SepiaApps]

Can anyone confirm if I try to approve my application that is currently active through Instagram's API Approval, do they disable the application if it doesn't get approved?

[rickydazla]

@SepiaApps you will remain in sandbox mode

[SepiaApps]

@rickydazla What I meant was, if my app is currently functional with legacy mode. (Active until June 2016) Will applying and being denied disable the application or will I still have until June 2016?

[goddamnyouryan]

Does anyone know what will happen to existing access_tokens on apps that go into sandbox mode in June? Will they still have the previous scopes, or be limited to the sandbox restrictions, or will they simply be invalid?

[kokarn]

As far as i understand it, all apps that don't update will be forced in
sandbox with the scopes that sandbox allows, EG default sandbox no extra
scopes.

On Mon, Feb 8, 2016 at 6:41 AM Ryan MacInnes [email protected]
wrote:

Does anyone know what will happen to existing access_tokens on apps that
go into sandbox mode in June? Will they still have the previous scopes, or
be limited to the sandbox restrictions, or will they simply be invalid?

—
Reply to this email directly or view it on GitHub
https://github.com/stevenschobert/instafeed.js/issues/345#issuecomment-181205238
.

[rickydazla]

Right. New apps need to be approved, old ones have until June to get approved. After June if you are not approved you are sandboxed.

[goddamnyouryan]

@kokarn @rickydazla right. But I have an app that has thousands of users connected to it, with corresponding issued access_tokens. Only the most recent 10 of those will still work? And with limited sandbox functionality? oi ve.

[rickydazla]

You better make a real fucking nice video then!

[callamwilliams]

Looked into this; it seems as if feeds for websites won't be approved; these will remain in sandbox mode and be limited to 500 requests per hour and 20 images. This doesn't sound like much especially for large clients, but if you cache your responses, it's not a problem.

The main confusion is because they have made it sound like every app/feed has to be approved and out of sandbox mode to work, where as the reality is that only fully functioning apps for phones, or a widget plugin really ever need to be.

You will no longer be able to display feeds based on hashtags, only a users own photo's. By getting a client to be a sandbox user, is how you can access their feed without their login information.

Older apps/feeds will need to be updated to use the new code before June or they may stop working.

It's mainly to stop apps hammering instagram's servers for unlimited requests on any hashtag/users they like. I'm not sure instafeed will continue to work, but there are several PHP solutions out there already. They just need to be modified slightly.

Here is an example of how to fetch and cache images using WordPress's 'set_transient' - you will need to use a loop to output the data.
WordPress Instagram Gist

Here is the relevant piece of information in the dev docs:

Here are some examples of scenarios that will not be approved:

• To display content for a personal website. If you are a developer and you want to showcase Instagram content on a website, then you do not need to submit your app for review. By using a client in sandbox mode, you will still be able to access the last 20 media of any sandbox user that grants you permission.
• One-off projects. If you are an agency building websites or other integrations, note that we don't grant permissions to clients created for one-off projects. If you are interested in building a product, platform, or widget that will be used as a service across multiple projects, then you may submit a single client_id that you can use across multiple projects.
• To use a widget. If you are installing a widget for your website, then you do not need to submit for review. Some widgets may ask you to create a new client id, but you do not need to submit it for review for the widget to work. Your client can remain in sandbox mode and the widget will have access to your last 20 media.

Hope that helps clear some confusion.

[steve-frapwell]

Hi all...as a business guy trying to get his first e-commerce site up that simply prints user's Instagram imagery (ie we're not a feed reading app), my developer has now downed tools (rightly) due to his fear about the "One-off project" clause...I could understand Instagram having issues with say an ad agency building something for a temporary, time-limited promotion, but does anyone know whether a genuine, bona fide, long term commercial venture would be excluded under this clause too? Thanks!

[rickydazla]

@steve-frapwell your developer needs a sand-boxed app that you need to authorize against your own instagram account. That will give him access to your most recent 20 posts.

[steve-frapwell]

Hi Rick.
Great - thanks for this...really appreciate the answer!
Steve
 Steve Frapwell
Director
RetroLaboratory Limited

  From: Rick Davies <[email protected]>

To: stevenschobert/instafeed.js instafeed.[email protected]
Cc: Steve Frapwell [email protected]
Sent: Thursday, 25 February 2016, 0:00
Subject: Re: [instafeed.js] [IMPORTANT] New Instagram API restrictions & how it affects Instafeed.js (#345)

@steve-frapwell your developer needs a sand-boxed app that you need to authorize against your own instagram account. That will give him access to your most recent 20 posts.—
Reply to this email directly or view it on GitHub.

[sagar-vaholiya]

Hello friends,
I want to get permission(From instagram) for access media of other users and store it in device's gallery.
"Basic" permission already approved. But they rejected for public_content.
Will i need "public_content" permission to access and save public user's media?
Because without that permission app works correctly.
And can i show ad in my app while i create screencast for submit for review?

I got following rejection:

https://app.box.com/s/wl0j5ymcii3vqs0mxozrhvch54h7kknr

_I repeat, I only need to access public user's media and user can store that media in his device's gallery._

[acamou]

Hi guys,
I'm having the same problem with error message "The access_token provided is invalid"
I'm using the javascript library were you only put the username and client_id but I get that error.
I already have the app ready were I got the client id from and I'm ok with using sandbox mode with only the latest 20 items, but it just won't let me.

[jeffreyho92]

@acamou
var feed = new Instafeed({
get:'tagged',
tagName: 'supreme',
userId: YOUR_USER_ID,
accessToken: 'YOUR_ACCESS_TOKEN',
limit:'100',
});

[slokhorst]

_Please_ mention somewhere in the readme that most of the examples no longer work. It is really frustrating to only find this out after an hour of experimenting.

[Samlilli]

Any updates on this or potential work arounds?

[enkota]

I believe all that works right now is to use an accessToken Doesn't seem to work now with only a clientID.

[Samlilli]

I see.. And who wants to store an access token client side? Haha

[enkota]

@Samlilli It's unfortunate, I've just had a hard decision of scrapping a feature in my theme due to Instagram's new policy...

[rafasegat]

Someone with public_content access?

[Samlilli]

@rafasegat for sure, if you can get it! I don't see why instagram don't provide the same features as Facebook do for embedding timelines, it's seamless and after all they're one and the same company now... Maybe they're working on it

[rafasegat]

Hi @Samlilli. Im sure they are working it, but I have a Instagram plugin developed and many users are waiting for the new version and I already tried many times get a app approved with public_content but all the time unsuccessfully. I already produced videos, huge content explaining but no way to get it.

Just want a tip from someone that already get it.

So thanks for your answer. Ill keep working.

[sagar-vaholiya]

@rafasegat,I also keep working on it. if you find solution, then tell me.

[acamou]

@jeffreyho92 the extra parameter that I see there is the access token but I don't want to ask for the user permission and authenticate with their account, I just want to show the latest posts in the widget.

[nemoeric]

Hey,
Also blocked because of those restrictions for new Instagram Client.
I would be glad to know if anyone finds a work around!

[rafasegat]

I got it.

I just included a video(youtube) showing how my application works and put a description about my project.

My description wasn't so detailed but I reckon the guy who check it was in a good day, because many times I tried almost with the same description and wasn't approved.

I Re-Submitted a Client that I tried 1 month ago and now showed some checkbox about the objective of my project. 2 hours later the permission basic and public_content was approved.

[rickydazla]

@rafasegat I'm curious what you are doing with public content. Is it a public app?

[rafasegat]

@rickydazla with public_content permission I have access to hashtag, location and user content of every user at Instagram. Very useful.

[rickydazla]

Sure @rafasegat but what are you _doing_ with it? What is the end use? Just curious.

[rafasegat]

WP plugin

[thugsb]

I've made a simple PHP script that grabs images from a specific user onto your server and updates a customizable HTML file that can be included in your pages. Feel free to use as you wish, and like this comment if you do. ;)
https://gist.github.com/thugsb/84c986d2167a77e3bc12
You can set the user_id variable to grab from any Instagram user. If you don't specify one, it'll grab the images from the account that the access_token is associated with.

[schrepel]

So I'm also having the "access_token invalid" issue (we're just trying to display our own Instagram feed on our site), and still can't tell from following this whole thread whether a) providing an accessToken parameter in the javascript is supposed to help (doesn't help us, we get a "this request requires scope-public_content, must re-authorize application" error instead, or b) if there's some definitive instafeed javascript code example that addresses the Nov 2015 Instagram policy changes. Sorry to be a dope, but I'm really unclear yet how this is supposed to work. Thanks.

[vncscoelho]

Can someone please explain the dangers of having the access token exposed in the script? Is there a way to hide it or protect it from being used outside of the domain I want?

[nemoeric]

@thugsb I am not really good at PHP yet. Could you please let me know how to call your script once it is set up with access token and hosted on my server in a "php" named directory ? Thanks!

[vncscoelho]

@nemoeric I guess it's almost impossible, I've researched and people don't provide pratical examples because there's no easy way. Even if you send the key via PHP, you'd have to expose it in order to the script work.

You should try this PHP Instagram plugin: http://pastebin.com/19gyGkMy

Just paste it in a PHP and call it in your HTML by using

[thugsb]

@nemoeric you can just use php instagram.php from the command line (when you're in the same folder as the script). In the cron you can do 0 * * * * php /path/to/instagram.php.

[photobaker]

@rafasegat
What did you choose from this list?

[pratik1230]

Hello Everyone,

My application need all permission from Instagram which is: like, comment, relationship, follower_list, public_content etc.

I am trying to get approve from Instagram since 4 month but no luck yet. can any body help on this. i tried many screen cast many descriptions but each i got rejected.

Thanks

[pratik1230]

@photobaker

i choose 1st option every time which you mentioned above.

[pmcbryde]

@goddamnyouryan Did you happen to sort out what happens to existing tokens after approval? We are in a similar position where we have a large number of existing clients with authorized tokens, and don't want app approval to force all of our tokens to be invalid due to missing required permissions.

[goddamnyouryan]

@pmcbryde no info, as of yet, but I think the safest route is to assume that without approval your tokens will no longer be valid. Let me know if you hear otherwise or get approval.

[yuchant]

What about for personal use? I can't get a feed even with ClientId and UserId set to myself. Is this expected? OP says the error only appeared when NOT using own UserId.

Sorry very confusing stuff considering the different experiences listed.

[pmcbryde]

@goddamnyouryan To update: We've gone through approval (we are part of the IG partner program and I'm not familiar with instafeed.js. This was just the best discussion on the web I've found about the changes :) ). Our legacy tokens maintained after being approved, and I believe any new tokens are similarly maintained through June 1st. I do believe that, without approval, our tokens would have been invalidated after June 1st. We are still waiting to see what happens to our legacy tokens after June 1st. I believe they will likely be disabled, but it's possible that they will revert to the previously approved permissions.

And @yuchant you should be able to access "self" for the token owner on a Sandboxed app (assuming that user is either the client owner or an approved sandbox user). Double check that your token is valid.

[vm6ej04]

Hmm...Sorry if I'm saying anything stupid, This is my first time working with Instagram API. Please do point out any of my misconception. THANK YOU!
I just want to grab our client's latest Instagram images and show it on their website...nothing else.

From my understanding:

1. You create a developer account to get a CLIENT-ID and set a REDIRECT-URI
2. You get an access_token using this method

https://api.instagram.com/oauth/authorize/?client_id=CLIENT-ID&redirect_uri=REDIRECT-URI&response_type=token

After doing that, you technically got this Token through your own app which is in sandbox mode.
It worked, but I'm just worrying the sandbox 500/hour limit.

Does that mean if more than 500 users visit their website within an hour, the token will no longer work?

After seeing this permission review option it reminded me of what @bakura10 said.

bakura10 commented on Jan 12
From what I understand, it is actually Instafeed that must manage to make their app to be accepted. If that works, then we can still use Instafeed to get our access token.

Does that mean in my user case, if Instafeed create an approved app(website) that helps us retrieve our Access_Token to be used in conjunction with Instafeed.js, it will be issued by an Approved app, therefore we all have the 5000/hour rate using that token?

Does anybody have an answer?
I'm currently abusing my access_token by refreshing my test page locally making requests every 2 seconds..(not sure if the request count as 1 since it's the same IP, or it adds up...). Any suggestion on a better way to test it are welcome.

UPDATE
Token still works after more than 500+ refreshes..am I doing anything wrong or I actually don't have to worry about the limit for my use?

UPDATE
Found an API testing app called Postman, run the test for code 200, here's the result. That's after 1000 request just before that one, and almost an hour of auto refresh. I'm guessing although my app isn't approved, still in sandbox. For simple use such as grabbing feeds you still get 5000/hour Rates Limits.

UPDATE
My apology.. I must have grabbed that Token from other places. (pixelunion) I changed it back to the token I generated, it is limited to 500 calls.. So Pixel Union either created that app before Instagram changes API...or has gone through the process of approval. Either case, I think it's safe to assume that if Instafeed can create an app that populate our tokens, we will get 5000 requests/ hour!? Any thoughts? Guess we can only find out after first of June?

[bakura10]

Hi,

Sure, this is a bit confusing so let explain you @vm6ej04 .

Actually, if Instafeed would have its application approved (I don't know if they do), you could indeed generate an access token there.

We are personally doing Shopify themes (like PixelUnion), and Instagram was quite critical for us. We actually created an app and we were able to have our use case validated (it's a bit complex, you actually need to explain them carefully how your use case fit into their new rules). We only managed to get the most basic scope though (it allows people to generate token and retrieve their own images).

PixelUnion also does Shopify themes and they run into the exact same issue as us, and went through the exact same approval process and, as far as I know, they were also approved like us. This means that you can generate access tokens through their tool. Because they have an approved app, you'll have the 5000 / hour rates limit :).

Obviously, it would be better to have your own app approved as if PixelUnion ever shut down and close their Instagram developer your tokens will be revoke, but I don't see them shutting down anytime soon so I'd suppose you're good to go :).

Hope it helps!

[vm6ej04]

@bakura10 Thanks for the explanation!
Mind linking me to your app? It sure is better having a backup access_token in hand :P

[bakura10]

Sure: https://maestrooo.com/instagram

[l30n]

Using the https://maestrooo.com/instagram access token I tried to get the public media of a user but it says "This client has not been approved to access this resource."

Does anyone knows any app that has access to it.

[MTphilclothier]

Yeah https://maestrooo.com/instagram didn't work for me either, sadly :(

[vm6ej04]

@SergioMLeon @MTphilclothier try http://instagram.pixelunion.net/

[l30n]

@vm6ej04 actually I tried with that app before coming to this thread but I got the same error, seems there are not app with public_content scope approved

[vm6ej04]

In that case I don't know then. I'm only using them to grab feeds, works fine for me with both of the tokens generated by them.

[l30n]

But you are viewing feeds from the same account that generated that access token right?

[vm6ej04]

Yes

[l3irdWings]

Hi @vm6ej04 pls test now again I use http://instagram.pixelunion.net/ and just get error same @SergioMLeon .
Who know how to fix it.

[thefunkybassist]

Seems like there has been an Instagram API update 1st of June?

Had to authorize the access token this way manually to retrieve a public hashtag feed:
1a) Enter URL: https://www.instagram.com/oauth/authorize/?client_id=...&redirect_uri=...&response_type=token&scope=public_content
1b) Made sure the redirect url matches with the one in the app
2) Get access token from the redirected URL
3) Add _accessToken_ in the "new Instafeed"-initialization in Javascript

Now it can't find any images though, not yet sure why because the given hashtag actually has images on Instagram..

"Uncaught Error: No images were returned from Instagram"

[yonarbel]

i managed to fix the issue with the link provided above ( http://instagram.pixelunion.net/ )
thanks @vm6ej04 ..

in order to display images from instagram you need to provide an authorized access key that linked to the same userid you are trying to import it's content.
now i must ask my customers link their account and provide me with the access token they receive from the link mention above
looks like i didnt have the accessToken key on my previous code because i managed to bring content without it and now it's mandatory..
if you have any question feel free

[vm6ej04]

@l3irdWings, refer to @yonarbel 's comment above. I've requested an access token again, still works.
"It worked!

Use this token in the appropriate field on your website or blog, and you should have a working Instagram widget...."

[Pogoss]

Hello! What should i do to use instafeed only for showing posts from instagram? I get accessToken, i enter clientId, userId but still get an error:
"error_type": "OAuthParameterException",
"code": 400,
"error_message": "Missing client_id or access_token URL parameter."

[yonarbel]

@Pogoss can you share your code snippets

[Pogoss]

init: function() { var feed = new Instafeed( { get: 'user', userId: USER_ID, clientId: CLIENT_ID, accessToken: ACCESS_TOKEN, limit: this.$container.data('limit') || 6, resolution: this.$container.data('resolution') || 'standard_resolution', sortBy: 'most-recent', after: this.onAfter }); feed.run(); },

[yonarbel]

you can remove the clientId, leave the access token only..

did you get the access token from the link above ? if yes, did you logged in with the same user your trying to fetch it's content ?

[vm6ej04]

Just a quick summary for people who simply want to grab feed images.
I've been working on a project where Instagram feeds are needed. And everything still works fine after first of June. Tested Token generated by following websites, you get 5000 request/ hour.

Requirement

1. You need to (or get your client to) log into the Instagram account which you want to grab feeds from.
2. Visit http://instagram.pixelunion.net/ or https://maestrooo.com/instagram/ (thanks @bakura10)
3. Authorise the apps to generate the access token

Sample code

var feed = new Instafeed({
    get: 'user',
    limit: '20',
    target: document.getElementsByClassName('slick-slider')[0],
    userId: USER_ID,
    resolution:'standard_resolution',
    accessToken: ACCESS_TOKEN,
    template:'<a href={{link}} target="_blank"><img src={{image}} alt=""/></a>'
    after: function(){}
});
feed.run();

USER_ID is simply the first few numbers before the dot in your Access Token

XXXXXXXXXX.12345678....

no client_id needed

[npapratovic]

So much thanks for @vm6ej04 I spent last two days for fixing this - this line

"USER_ID is simply the first few numbers before the dot in your Access Token"

Saved my day, I never knew that userId is contained in accessToken, and couldnt find the userId because all the services that provided this were down

Thanks again

[codinpsycho]

Any chance I can still get data based on hashtag (not just from my own profile, but from different profiles also), like we previously used to get from instafeed. It stopped after 1st June. Now I am getting this

"Uncaught Error: Error from Instagram: The access_token provided does not match an approved application"

My access token isn't approved and don't think it falls under any use case that they have mentioned in their documentation. This is a big bummer, I am using it for my own site.

I tried generating an access token through PixelUnion. But then its saying this

"Uncaught Error: Error from Instagram: This client has not been approved to access this resource."

Seems like their app hasn't been approved for that as well. No idea how to go forward with this.

[Pogoss]

@yonarbel

did you get the access token from the link above ?

No, i was getting it from instagram tutorial

[karlnoelle]

I'm having the same issue as @codinpsycho – I was pulling a group of hashtagged images and now they're not displaying. I generated an accessToken from http://instagram.pixelunion.net/ and modified the code to pull only a get: 'user' but that's not working for me either.

var feed = new Instafeed({
        get: 'user',
        userId: 'xxxxxxxxxx',
        accessToken: 'xxxxxxxxxx.rest-of-access-token',
        resolution: 'standard_resolution',
        limit: 4,
    });
    feed.run();

Am I missing anything?

[Pogoss]

@yonarbel Thanks, that works for me. I try your variant

[thefunkybassist]

@karlnoelle @codinpsycho If the accesstoken is not working, try https://www.instagram.com/oauth/authorize/?client_id=[CLIENT ID]&redirect_uri=[YOUR REDIRECT URL]&response_type=token&scope=public_content. You should see an authorization dialog.

Now I am curious what happens when the token is correct, still haven't got a working hash feed.

[yonarbel]

@codinpsycho , i think you are not able to bring these tagged content.
due to the new privacy policy you are able to bring only your own.. this is my assumption

Thanks Instagram for making it so difficult for us :)

[codinpsycho]

@yonarbel exactly man, such a pain and no idea how to get them also.
Btw, @karlnoelle I am able to get my own content with the same code that you mentioned, with the access token generated from pixelunion.

What's the error being shown in the console?

[despecial]

Since people don't take the time to read, here is a short info about the Instagram API changes which effect all scripts that show feeds on websites.

Most important: Instagram don't allow and won't let you show feeds from other users on your site (that includes search by tag). The only thing you can do, after you got an access token, is to show your own pictures.

There is no fix and nothing to fix, they made an announcment half a year ago. If you have an app you must request client id, etc. But thats not important here.

So... just get your access token and insert it to show your own media.

[l30n]

@despecial I'm aware of that what I'm looking is for an app that has the public_content scope approved so I can bring public info of others users, the 2 apps from above only has the basic scope which is limited to the own user content

[codinpsycho]

@SergioMLeon Exactly what I am looking for. Update here if you find any.

[despecial]

@SergioMLeon @codinpsycho
This is not the place to ask for app support. You can request to get your app out of sandbox mode if you belong to one of the following groups mentioned here: http://developers.instagram.com/post/133424514006/instagram-platform-update

Simplified platform policy

We’ve updated our Platform Policy to explicitly list the use cases we will support moving forward. These include apps and services that:

• Help individuals share their own content with 3rd party apps, such as apps that let you print your photos and import an Instagram photo as a profile picture.
• Help brands and advertisers understand and manage their audience, develop their content strategy, and get digital rights to media. Established apps in this space may apply for our newly announced Instagram Partner Program.
• Help broadcasters and publishers discover content, get digital rights to media, and share media using web embeds.

[catsgomeyow]

I just checked my client's website and see that the instafeed section is blank; no longer pulling in the hashtag they wanted.

So, put this in dummy terms for me please. Basically you can no longer pull in a specific hashtag to your website using instafeed? Yes or no.

[rustinlee]

History repeats itself...

Catastrophically awful decision by Instagram, going the Twitter route of requiring ridiculous authorization measures to query _public information_. Nothing is accomplished by this at all except forcing end users to switch to hacky scrapers instead of a clean documented API.

Wonder how many more social media companies will elect to go this route before they start learning from the others.

[thefunkybassist]

@rustinlee 100% agreed. For the average site, getting some basic Instagram info just became a huge pain. Most of that access is only available for the larger scale sites that make it through the checklist during the submission process.

[rustinlee]

@thefunkybassist The problem is that there is no clear delineation on Instagram's (or Twitter's) side between desktop/mobile native application written that functions as a complete Instagram client replacement allowing people to manage their profile and upload photos, versus a purely client-side JS web page that just wants to display publicly available data and will never need write permissions.

I don't have a solution to this problem, just sick of seeing it happen for no reason.

[cesarvelame]

I'm getting error 429, too many requests.

Failed to load resource: the server responded with a status of 429 ()

[staze]

As a group that used instafeed for a single digital sign in a higher education environment, this is a huge disappointment. I don't see why they couldn't have two tiers of API access. One that does their dog and pony show "give us a video feed of your product" and one that is "okay, you can have access, but you're limited to X queries per hour". They do that in sandbox, but only for YOUR content. Just boggles. Now, we'll just encourage our students to use a different product that we can actually access. Sure, it's a drop in the bucket for lost users, but it's still lost users. =/

[YoniSL]

Is there a 3rd party application around that is verified and requires the public_content scope? I am just looking around for an access_token. Gave up hope after instagram required a "screencast" of the login process while I use command line to take care of that.

[YoniSL]

@JamSliv Merely using your client_id would be preferred

[mgrn0]

@JamSliv you are kidding, right?

[xxrobot]

For those of you that don't want to grant access to pixelunion the format to send your credentials is

Go to the url below, and replace SUPERCOOLCLIENTID and THATURLTHATYOUGAVEINSTAGRAM with their respective values that you created at https://www.instagram.com/developer/

https://www.instagram.com/oauth/authorize/?client_id=SUPERCOOLCLIENTID;redirect_uri=http://THATURLTHATYOUGAVEINSTAGRAM&response_type=token

When you are redirected back to http://THATURLTHATYOUGAVEINSTAGRAM copy value in your URL bar for http://derp.com/#access_token=DERPYACCESSTOKEN

[ronilaukkarinen]

Yeah, just noticed this today. Half of our sites IG-feeds are broken, since we love hashtag feeds.

accessToken set properly, getting this:

all.js?ver=1.0:5 Uncaught Error: Error from Instagram: 
This request requires scope=public_content, but this access token is not authorized 
with this scope. The user must re-authorize your application with scope=public_content 
to be granted this permissions.

And public_content can't be applied any longer:

I want to display hashtag content and public content on my website. - 
This use case is not supported. We do not approve the public_content permission for 
one-off projects such as displaying hashtag based content on your website. 
As alternative solution, you can show your own Instagram content, or find a company 
that offers this type of service (content discover, moderation, and display).

Really bad call, Instagram. Forced to switch to user feed.

[ryanschmidt]

@xxrobot since this is likely unsupported, does anyone else thing this is a bad idea that probably won't work for long?

Edit: I went ahead and tried anyhow :) but it appears to no longer be working.

{"code": 403, "error_type": "OAuthForbiddenException", "error_message": "Implicit authentication is disabled"}

Edit2: I had Disable implicit OAuth checked. Once I removed that, it worked. So bad to the original question...

[xxrobot]

@ryanschmidt that URL was to get your access token without having to use a 3rd party site like pixelunion.

You're right, it will probably break. The documentation says not to assume that your access token will be valid forever. https://www.instagram.com/developer/authentication/
And with your access token you can only access your own feed, no hashtags. :(

[ryanschmidt]

@xxrobot ah, that's the part I was missing. I am only looking to access hashtags so this "hack" isn't what I thought it was. I thought it was a temporary around the restriction which is why I was assuming it would soon not work.

[electrikfreak]

This worked for me:

https://www.youtube.com/watch?v=0k4RhTS94Hw

https://gist.github.com/mojaray2k/b502d75dd7a9fa277876

[safarious]

@electrikfreak I've tried this out but get following error:

main.min.js:3 Uncaught Error: Error from Instagram: This request requires scope=public_content, but this access token is not authorized with this scope. The user must re-authorize your application with scope=public_content to be granted this permissions.

[lebzuch]

@safarious
https://gist.github.com/mojaray2k/b502d75dd7a9fa277876
and
http://stackoverflow.com/questions/36471505/instafeed-instagram-this-user-does-not-exist
worked for me.

&scope=public_content is the key in your case.

[ferdogan]

@bakura10 hi, can you send the link of the screencast video for submission?

thank you

[ctmaloney]

@safarious,

@lebzuch is correct with the &scope=public_content that was the key for me.

It needs to be added when you generate your access-token, then you can read any user feed. You _do not_ need to invite the user to be a sandbox user for your new app. You need to authorize yourself with the public_content scope and invite the user to your sandbox app.

So, do this: https://gist.github.com/mojaray2k/b502d75dd7a9fa277876

But use the following for getting an access-token (Note the scope param):

https://api.instagram.com/oauth/authorize/?client_id=CLIENT-ID&redirect_uri=REDIRECT-URI&response_type=token&scope=public_content

Then you can search for the user id with:

https://api.instagram.com/v1/users/search?q=USER-NAME&access_token=ACCESS-TOKEN

And get their feed with (or drop the user id and access token into instafeed):

https://api.instagram.com/v1/users/USER-ID/media/recent/?access_token=ACCESS-TOKEN

[callamwilliams]

@ctmaloney this only returns results for the approved account, the search doesn't return the user ID it gives this:

{ "meta": { "code": 200 }, "data": [] }

and if you do provide a user ID other than your own you get:

{ "meta": { "error_type": "OAuthAccessTokenException", "code": 400, "error_message": "The access_token provided is invalid." } }

Looks like it needs to be outside of Sandbox mode to return ANY users content

[aymandi]

Hi there,
I have my application approved on all the Permissions so far except the "relationships" is pending.

I am performing an api request on the user's behalf through out their tokens to retrieve the media feeds of a separate page on instagram using the below URL

https://api.instagram.com/v1/users/texasffa/media/recent/?access_token=3438260254.0a8fe73.381847b1f74f4e29b9d0aaec82934344

(The access token is fake)

This page is redirecting me to an instagram "page isn't available"

Is this API deprecated ? Is it the right way to read other page's feeds?

[stevenschobert]

@aymandi Looks like you have used an account username texasffa, where you are suppose to use the user ID 21345123.

[ctmaloney]

@callamwilliams interesting... I have an app working in just the way I described above, but I'm definitely getting the same output as you if I try it with a different user... it still works fine with the account I had originally set it up for.... I'm going to play with this some more and see if I can figure out what is happening.

I am definitely grabbing images from a clients account through my sandbox instagram app though, it is pulling into their website just fine.

[jacobraccuia]

@callamwilliams @ctmaloney I ran into the same issue that callamwilliams described. I can pull my own account fine, but even with the public_content tag, it won't let me pull from another users. According to the instagram documents, I needed to add them as a sandbox user. It wouldn't let me even authorize my app because it said authorization was unnecessary if I just wanted to grab one users feed...

So now i'm awkwardly waiting for my client to accept the sandbox invite... 👎

[ctmaloney]

@jacobraccuia they could at least send an email with the invite, but no, you have to have your client go find the developer page and the invites tab.

Still not sure how a couple of mine are working right now without having the client accepting an invite, but it is...

[jacobraccuia]

@ctmaloney thanks for the heads up! I have their login info so I went to the developer site for them and accepted it. That is absurd though, I assumed it just sent an email.

cheers!

[zergiocosta]

Note from the author: Please do not use this URL to generate tokens, it has security risks. See my comment below for an explanation.

hey ppl, try this one:

https://api.instagram.com/oauth/authorize/?client_id=YOUR-CLIENT-ID&redirect_uri=YOUR-REDIRECT-URI&response_type=code&scope=basic+comments+follower_list+likes+relationships+public_content

after a few hours, finally worked for me =D

[stevenschobert]

@zergiocosta I very strongly recommend against doing that. You are essentially requesting every single scope possible, which is potentially dangerous. You should only need basic and public_content.

If you generate a token with those scopes, the token will have the permission to follow/unfollow people (relationships), like/unlike on your behalf (likes), comment/uncomment on your behalf (comments), and see what followers you have (follower_list), and who you follow (follower_list).

You are basically giving that token full access to your account, and if your token is going on a _public_ html page, anyone who finds that token could potentially use it to act on your behalf.

Do not generate tokens with anything more than public and basic_content.

[zergiocosta]

@stevenschobert yeah... public_content is what the error points to... of course you must choose what you might need in your application! I forgot to mention that, but thank you a lot and sorry for that miss! =p

[callamwilliams]

Waiting 3 working days now for approval ~230 feeds down, and obviously don't want to have to chase that many clients up to authenticate our app if possible - our hotfix for the minute is to use the same access point Instagram uses to display their images http://www.instagram.com/username/media

[steven-klein]

@callamwilliams Thanks for posting that URL. It's working really well for me in the interim.

[arturmamedov]

@callamwilliams its legal? work perfectly! :smile:

[felipe-l]

I barely started using instafeed last week and I got it to work! However i have some questions, Ive been looking all around the internet but couldnt find anything.

1.) is it dangerous/risky to have my access token open to the public, can they do any harm to my account?

2.)is there any way to hide my access token, I have my java script file out in the open so if anyone wants to see my access token they easily could is there a way I can keep that javascript file hiddent or something like that?

Any help would be appreciated, I am kind of new to coding so I might have noob questions but soon ill understand :p

[mgrn0]

@felipe-l - you cannot hide what you put in Javascript, you can obfuscate but you cannot hide it. therefore you should only grant access to your web app what it absolutely needs (only read rights, no modification stuff) as mentioned above by @stevenschobert.

Do not generate tokens with anything more than public and basic_content.

[felipe-l]

@mgrn0 so when getting my access token it says "Access your basic information Your media & profile info" does this mean they will only be able to access my public information, which means its safe to have it public? One more question, so is it possible to only allow the access token to work on my web app. Thanks a lot! I really appreciate the help :D.

[photobaker]

I have approved for public_content clientId. To get access token I send request to www.instagram.com: GET /oauth/authorize?client_id=MyClientId&redirect_uri=MyRedirectURL&response_type=code&scope=likes+comments+public_content HTTP/1.1

After authentication browser redirect me to MyRedirectURL and I can get code from URL.

With this code I send request to api.instagram.com: /oauth/access_token HTTP/1.1 client_id=MyClientId&client_secret=MyClientSecret&grant_type=authorization_code&redirect_uri=MyRedirectURL&code=CodeFromURL

But sometimes I get response HTTP/1.1 400 Bad Request. This situation continues for a few hours and sometimes for a day. It is interesting that problem is very unstable, I may have two client apps that make identical requests. And one app will works fine, and another will fail at the same time. Looks like it is a problem somewhere in Instagram infrastructure.

[codehandling]

Try our free Instamax plugin that works with a Access Token and eliminates the Client ID problem -
http://demos.codehandling.com/instamax_demo/instamax_live_edit.html

[rickydazla]

@stevenschobert you had said you were _"evaluating options for how to handle authentication going forward."_ What is your current take on the situation and future of instafeed.js? What would you recommend someone do right now if they wanted to use your plugin to embed media beyond the scope of their own most recent 20?

[stevenschobert]

@rickydazla Thanks for asking!

My original goal was to build a helper page that would allow users to log in with their Instagram accounts, and it would generate the token for you, as well as give you some copy-paste snippets for getting started with Instafeed.js.

However, after I made the helper page, and submitted it to Instagram for approval, it was rejected. The library name "Instafeed.js" doesn't fit within their brand guidelines ("insta" is not allowed).

I reached out to a member of the Instagram team, and they aren't making any exceptions to this rule. So without renaming the library, I don't think I'll be able to build any approved apps to help with this process.

I'm not opposed to renaming Instafeed.js (though it'd be a bummer), but even if I did, I don't think my helper app would be approved. My understanding is that Instagram wants everyone to submit their API access requests independently.

I realize this is disappointing for everyone (it is for me too, I don't even have an approved app for my own personal use). At this point, I don't have any ideas on what to do from here, so I'd love to hear from the community if anyone has recommendations.

[felipe-l]

@codehandling is this 100% open source? can i use it in my personal website without giving credit?

[codehandling]

@felipe-l I send the 100% open source code only to my subscribers. If you are interested, you can join CodeHandling here.

Feel free to use it on your personal website or anywhere you like :)

[felipe-l]

@codehandling Yea i subscribed and was able to download the code! very useful and extremely easy to use thanks alot! cheers

[gaialogic]

Hello!
Anyone that have request public_content had success with Instagram approval??
Anyone received a different automatic response?
"This permission (public_content) is only granted to apps that enable brands, advertisers, broadcasters and publishers to discover public content. We do not grant access to apps that do not fall into these categories. Please review our documentation (https://www.instagram.com/developer/review) for more information"

Anyone know Instagram support contact for developer??
is the six time that I try this submission!!
Thanks

[sebhorin]

@gaialogic at the moment the simplest solution is to scrape it:
http://stackoverflow.com/questions/37993827/scraping-data-from-instagram

[gaialogic]

@sebhorin I Have the same Idea, my boss doesn't want :)
the question it is ethical and legal?:)

[despecial]

It's against their API rules. Definately not "legal".

[highone]

http://www.codehandling.com/p/codehandling-free-plugins.html
"This website is temporarily unavailable, please try again later."

On Wed, Jun 29, 2016 at 8:26 AM, Jake [email protected] wrote:

@felipe-l https://github.com/felipe-l I send the 100% open source code
only to my subscribers. If you are interested, you can join CodeHandling
here. http://www.codehandling.com/p/codehandling-free-plugins.html

Feel free to use it on your personal website or anywhere you like :)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/stevenschobert/instafeed.js/issues/345#issuecomment-229259805,
or mute the thread
https://github.com/notifications/unsubscribe/AFT8uAUVPxuQlnqrrLkG2lZrISo_7YNkks5qQgIZgaJpZM4GmbEi
.

Emir E. Uckan
[phone]
www.emiruckan.com
www.yapiyorum.co // www.iamBuilding.co

[codehandling]

@monimen Yea, fixed some issues with my DNS settings. You should be able to access the page now :)

[aubot]

@gaialogic I need too. Can anybody help us?
I am ready to pay. Cantact me [email protected]

[bsullins]

@stevenschobert can you share the code you used to get the sandbox mode working? For my use case, and I suspect many others, I just need need the last 9 or so images

[bux21]

I was approved for basic only and not for public_content... so I have an app that wants to connect/share users instagram photos to their profile, just like how Tinder does. So public_content has to be used for this, right? or can basic permission also accomplish instagram photos to your profile?

[armyofda12mnkeys]

Just curious, I am new to this... I registered my 'client' and have a clientId and used that api.instagram.com/oauth/authorize link to give my website public_content perms.
Are we still limited to only getting 20 pics still via any client-side js like Instafeed.js?

If I switched to a different server-side/php plugin, would that then be easier to get more than 20 pics?
Is there an easy way getting Instafeed.js to return >= 20 images? I guess I saw maybe people caching old images via more complicated solutions so they can serve >= 20 (and even Paginate), but would rather not go that custom route on my Drupal server (Im already customizing enough things on there :) ). Definitely liking the simplicity of setting up Instafeed.js and extra complexity it offers if I need it for templating.

Thanks,
Ari

[minimaluminium]

@bakura10 Hi, I develop WordPress themes and use PixelUnion app to generate tokens for the Instagram feed section of my themes.

I have tried to get basic permission several times with no luck. I see that you got basic permission for your app successfully. It would be really helpful if you share from your experience like which use case you chose and how you described it.

[bakura10]

Hi @sodbileg ,

I don't remmeber exactly but if I think I emphasize on the number 3 use case, saying that we're helping broadcasters and shop owner to share media using their own account.

We explained that this is used only to help shop owners to promote their own activity with their photos only.

Then we attached a short video showing how the integration work, from step 1 where they use our website to fetch the token, to the final result on a real-life store showing our Instagram integration.

[minimaluminium]

@bakura10 Thank you so much for your reply. It helps me a lot.

[nachiketghelani]

Hello,
My basic permission not granted. can you help problem related to below
In instagram login can i login without instagram login authorize page without ask permission like "Access your basic information".

[l-landier]

Hello,
the instafeed is working for me, but it's publishing every post twice.
Wich means if I do limit:"4", I'll get 8 post, with every post in double (4 different images twice).

Anyone knows why?

[fabolousfrances]

Hi,

here is my script :
<script type="text/javascript"> var feed = new Instafeed({ clientId: 'myclientid', accessToken: 'myaccesstoken', template: '<a href="{{link}}"><img src="{{image}}" /></a>', sortBy: 'most-recent', limit: '10', resolution: 'thumbnail' }); feed.run(); </script>

I just want to display the 10 last post from my instagram account on my website.
With this script, I have this error : error : invalid media id.

Of course my application is declared on instagram website and is in sandbox mode.

Thanks for your help.

[Emi-C]

@callamwilliams To complete your answer in case anybody else struggles in making their app being approved by instagram, in this scenario instagram doesn't allow to make jsonp calls on https://www.instagram.com/username/media/ so basically you have to put up a ws which is something like echo file_get_contents(https://www.instagram.com/username/media/'') and then make a std ajax call on that ws to avoid obviously cross origin issues.

[mannyvergel]

Hi Guys, I've been following this thread a lot before I got approved to find all the clues on how to get approved because it was really frustrating that Instagram kept on rejecting my app even if I followed all their instructions and terms.

So I just want to share to the community on what I did how I my Instagram app got approved. So just the usual disclaimer, this is not a guarantee that you'll get approved, but I hope some of the things below make sense.

1. Use all the combinations, polish, be patient, never give up

• This sounds like a cliche, but believe me, Instagram will really test your patience. I actually stopped for two weeks from submitting out of frustration, before I re-submitted my last 2 submissions and got approved the last time.
• The trick is constantly polishing the 3 combinations you're submitting:

i) Choosing the use case - "Which use case best describes your Instagram integration?"

ii) Describing the use case - "How does your app use this permission"

iii) Screencast - "Video Screencast URL"

2. Choosing the use case issue

• So one of the most confusing part of the submission is the use case. And up to now I still do not fully understand those that are related to public_content permission. So basically I chose between two permissions to justify my need for public_content:

a) "My product helps brands and advertisers understand, manage their audience and media rights."

b) "My product helps broadcasters and publishers discover content, get digital rights to media, and share media with proper attribution."

And I kept choosing (b) when submitting my app but I only got "basic" permission approved using it. I submitted so many times using (b) and just kept changing my video screen cast, and API use case paragraphs.

It was when in my last two submissions and I chose (a) that I got approved.

3. Describing the use case

• Another confusing part is Instagram asks you to describe the API use case in section 3 then in section 4 when you choose additional permissions, it asks you to describe it again: "How does your app use this permission". Which to me, "Why? I already described everything in detail in section 3!"
• I tried a lot of combinations here, I tried Use Case description and public_content description to be completely different, and describe each in detail, but to no avail. Always rejected. In my last two submissions, I actually got tired already of making long paragraphs, so I wrote a new one in full details how I'll use the permissions I needed. Including the technical details (like the logic in the program) and just copy-pasted it both in section 3 and 4. Since my basic permission was already approved at this point.

4. Video Screencast

• I did a lot of revisions in my youtube video and re-submitted several times. I tried a long introduction to say what I said in my use case, did not work. I tried incorporating live video of our events in different brands, did not work.
• What really worked, I think, was to be straightforward, focus on the use case, and include technical details as well. So what I did was made the introduction very concise, like only few seconds long, and went on with the flow, and as I was describing the flow (logging in to the website, etc), I was explaining as well the programming logic behind the decision related to the API use case of Instagram. Like when it's time to integrate with Instagram auth, I'll switch to Sublime Text and show them a piece of code where I'm actually using the IG auth. Same way with public_content permission.

You have to convince them that it's not a one off project, and your video really satisfies the use case you explained and selected. I also stayed away from discussing about web gallery integration, coz I have a feeling that they automatically reject this kind of app (not 100% sure).

Another good chance that you're in the right direction is when your rejection message changes. My second to the last submission, the message changed from permissions issue to issue about our brand might mislead people that we are partners with Instagram. So in the final submission, I just removed Instagram mentions from all of our brands (also had to re-do the screencast because of this).

I actually got teary eyed the morning I checked my Instagram client and got the coveted green button "Approved" for public_content instead of the denied button with a vague message why your app was rejected. Instagram doesn't even notify you if there are changes in your permission approval, so it's a daily anxiety of checking in the developer centre.

If anyone wants to check out more about the use case of my app, you may do so, and yes this is a slightly shameless plug as well: it's "Hashtag Circle". I won't post the link as it's straightforward what's the website, and we're on social media as well.

Now, I don't know if all of the above changes really amounted to something or it was just like "a guy from Instagram was having a good day" so I got approved. Maybe luck, maybe not. Or maybe they're starting to loosen up, haha! But this was my experience, I hope it helps! And thank you as well as I learned a lot from this thread.

[minimaluminium]

Hi @mannyvergel,

Thank you so much for sharing your experience. It is really really really helpful. I just have one quick question.

Do you think there is a chance of public_content approval for Instagram photo printing service if it doesn't print from hashtag? People really want to print their friends' photos, however, I have only basic permission. I just would like to know how you feel about this as a person who got public_content permission (YAY! Congrats on your approval!)

[mannyvergel]

@sodbileg I believe so! There are other end points that use public_content without using hashtag, e.g. the media based on location or the user media end point. However, reading your initial description I already feel that the case is very weak to get public_content approved.

It's really important that you relay properly the details that build your case that this is not for one-off use, and you fall specifically on the use case you chose. It's rationalising to them that you're using the specific end point that needs public_content permission to achieve your use case.

[JeromeVi]

So to resume actually it's "impossible" to grab all public images by an # and display them on a website ? Thank you for the answer

[mgrn0]

from what I followed the discussion for the past months, if you don't have a real plausible explanation (and a good amount of luck or a well known name behind your project), yes.

[JeromeVi]

@mgrn0 Okay it's pretty sad because I tried to implement a Twitter list based on # but you can't do a reactive one (You need to create a widget for each Hashtag) and I can't with Instagram too...

[mgrn0]

if you read through the thread here, there is plenty of options to work around restrictions - which might be sufficient for personal projects..

[JeromeVi]

@mgrn0 I readed the discussion and yeah I didn't find a way to display a list of posts by a specific # (For the moment I display my 20 last pictures because that works )

[thugsb]

I gave up on the API. I created a PHP script that scrapes the actual page and extracts the JSON on my account page, which includes all the details necessary to copy the images to my local server, and create an includable file. I run it by cron every few minutes.

The full script I currently use is here, and I've extracted the more important code below:
https://github.com/thugsb/wsdl-cascade/blob/master/scrapeInstagram.php

$curl = curl_init();
curl_setopt_array($curl, array(
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_URL => "https://www.instagram.com/".$account.'/'
));
$curlresult = curl_exec($curl);
curl_close($curl);

$scrape = preg_match('/window\._sharedData = .*environment_switcher_visible_server_guess": true}/', $curlresult, $matches);

$json = str_replace('window._sharedData = ','', $matches[0]);
$data = json_decode($json);
$media = $data->entry_data->ProfilePage[0]->user->media->nodes;
foreach ($media as $key => $value) {
    copy($value->thumbnail_src, "./instagram/".$account.'-'.$value->code.'.jpg' )
    // Also add code for this image to a variable, e.g. $HTMLoutput .= "<img src='". $value->code ."'.jpg''/>";
}
// Write the $HTMLoutput to a file.

Hope it's helpful.

[JeromeVi]

@thugsb I've seen earlier this script but how should I use it ? I need to run it on my computer ? Include it in my project ? (Sorry for spamming)

[thugsb]

Yes, you would need to create a PHP file on your server that you run on the command line via a cron task. If you don't have that kind of access to your server, this solution probably won't work for you.

[ronilaukkarinen]

For the ones who are still having this discussions, you should check out PHP-Instagram-Grabber or for Image hashtag feed for WordPress.

[cepka]

just insert tags you want to get feed and get feed url
http://mydreams.lt/instagram-scraper/

[gbutiri]

It's baaaaack!

[ben-raboine]

Error is back for me too gbutiri. Anyone have a fix? Thanks, Ben

[fagia]

same issue here...

[edarioq]

Same, none of the above comments worked for me, tried to submit for review but:

You do not need to submit for review for this use case. Some widgets may ask you to register a new client ID, but you should not submit it for review for the widget to work. Your client can remain in sandbox mode and the widget will have access to your last 20 media. If you are having issues with the widget, please contact the owner of the widget directly.

I had to use something else and that is working fine for me, so I believe it's up to the developer to get this resolved.

[yosefkurniawan]

Hi guys, I just got an issue that I think it is probably related to this thread.
My client just reported that our instafeed is not working lately. It's just showing 1-2 images.
I've been trying to run instafeed in plain js, and yes it just returns 1 image right now.
Here is the url of api request:
https://api.instagram.com/v1/users/1834716219/media/recent?access_token=1834716219.78c795b.144cef2e29a4459eb86f2304548c7a51&callback=instafeedCache53f6eb524171d00a.parse
I have tried to create new app with the same IG account.
Weirdly, if I try with another app from another IG account it works to return 20 images.
url request: https://api.instagram.com/v1/users/222640218/media/recent?access_token=222640218.2900948.99c831db9eb044f3b99889507c33f8e6&callback=instafeedCachec08b7d4b445153dd.parse

NB: both apps are in sandbox mode

Does anybody know what happening here?

[benjamin-hull]

@yosefkurniawan - those two example requests are using two different User ID's 1834716219 and 222640218. Is that a typo? That would explain the differing results, right?

[yosefkurniawan]

It is not typo. Indeed they are different. I just want to show why it works on an app but doe not work on another app. Both apps are sandbox mode.

[benjamin-hull]

The "non-working" profile here: https://www.instagram.com/lovebonitoid/ has zero posts as of now (in fact, when I first checked, I got 1 media item, now I get zero. Is that an account you control?

[yosefkurniawan]

OMG, that's becoming weirder. No, it should have a lot of posts. I accessed that page via desktop browser around 7 hours ago, the posts were still there. Now they are gone. But if you check via mobile app right now, the posts actually exists.

[despecial]

Looks like that account is "broken" or somewhow blocking all external accounts (it's the same message when you get blocked by an account). you can see there are over 2000 posts and it's even verified. Would suggest to contact IG about this issue.

[yosefkurniawan]

hi @despecial thank you for your response.
yeah, I think I need to contact IG about this.

[bux21]

Just received another Instagram API email update that accelerated most of the api use disabled, effective immediately. Then these will be disabled:

Public Content - all remaining capabilities to read public media on a user's behalf on December 11, 2018
Basic - to read a user’s own profile info and media in early 2020
————

My question is when Basic is removed will anyone be able to still login with Instagram username to an app? Like the typical web view within app and logging into Instagram to Auth? Like tinder you can login in once to connect your Instagram so users can view your profile.

[benjamin-hull]

@bux21 's update is in the changelog here, I think: https://www.instagram.com/developer/changelog#april-4-2018

The following endpoints are deprecated immediately:

Follows and Relationships

GET /users/self/follows
GET /users/self/followed-by
GET /users/self/requested-by
GET /users/{user-id}/relationship
POST /users/{user-id}/relationship

Commenting on Public Content

GET /media/{media-id}/comments (Deprecation not relevant when fetching comments for self media)
POST /media/{media-id}/comments
DEL /media/{media-id}/comments/comment-id

Likes

GET /media/{media-id}/likes
POST /media/{media-id}/likes
DEL /media/{media-id}/likes

User Search

GET /users/{user-id}
GET /users/{user-id}/media/recent
GET /users/self/media/liked
GET /users/search

Subscriptions - to receive notifications when media is posted
Some information on Public Content returned through hashtag and location search will be removed - Name, Bio, Comments, Commenters, Follower Count, Following Count, Post Count, and Profile Picture

To me, these "effective immediately" deprecations smell like security patches (or security theatre) as a damage control response to the Facebook data leakage media storm that's going on at the moment. The deprecated endpoints focus on the social graph: what people like, where they comment, who they follow, etc. That 'spiderable graph' is exactly what Facebook is in trouble over at the moment.

[richjdsmith]

So just confirming, as of 2020, we're out of luck for any means to pull pictures from a site hey?

I looked into scraping and Facebook has kindly decided to use random hash generated class names and ID's so that scraping is off the table :/

[benjamin-hull]

That's correct: "Complete deprecation in early 2020".

Regarding scraping, the reason you're seeing those classes in the DOM is because instagram.com is a React app and the DOM is all built with javascript. Scraping it would still be technically possible, but a) complex, because you need an agent which can execute javascript, and b) against IG's terms of service, and so likely to be thwarted and/or get IPs blocked, the target account in trouble, etc.

It's a shame that IG's as a platform for embeddable content is going away, but (IMO) better to accept it than spend forever trying to swim against the current.

[richjdsmith]

@benjamin-hull I didn't realize it was React that made such ugly classes - TIL!

It's a shame they're doing this. Further research has hinted that they'll be migrating User Profiles (non-business ones) to the FB Graph API sometime early 2019, but who knows with what restrictions.

It's a shame that IG's as a platform for embeddable content is going away, but (IMO) better to accept it than spend forever trying to swim against the current.

Yea it is. It's a great way to show social proof that there is something more behind the website by showing their social presence.

Scraping as a Node app would be possible with a reverse proxy and done via Pupeteer or something, but I don't know if/how it would be possible to do it in-browser. Shame really.

[MoOx]

@richjdsmith React does not create those ugly classes. You can use React with normal css classes. It's just that with React ecosystem, most people use a "css-in-js" solution that often generate classes name to avoid collision so you don't have to think about those. Twitter is using the same technique this days. Like all "big corp" apps. Easier maintenance.

To go back to the main problem here, I think we could go and use graphql api as soon as it's available for normal users...

[benjamin-hull]

Ah, it's the CSS-in-JS stuff, that makes sense, thanks.

Thanks for the heads-up too, @MoOx - I'd missed the announcement that the Graph API would be opened to individual users. Last I saw, it was only announced for businesses. Have to do some more reading - cheers.

[ag-coder]

Any news on this topic?

[saifalfalah]

Wouldn't we be able to pull media objects for Business Profiles through the Graph API?

[cedee]

Oh, I just read that now, too bad! Yesterday I was happy to finally get my Instagram feed on my site with instafeed.js, and now I'm reading that it won't work any more soon... I hope that there will be something similar then...?

[dalemartyn]

I think they've added basic permissioning for non-business profiles now to the new graph api: https://developers.facebook.com/docs/instagram-api/reference/media

[stevenschobert]

Hey @dalemartyn! Thanks for the comment and link!

Maybe I'm missing something, but I'm still not seeing any mention of support for standard user accounts in the Instagram Graph API documentation. What were you looking at that made you think standard accounts would be supported?

Here's what I'm seeing on the Instagram Graph API Overview page:

All endpoint requests must include a Facebook User access token. However, unlike Facebook users, Instagram users cannot grant your app access tokens directly. Instead, they must connect their Instagram Business Account or Instagram Creator Account to a Facebook Page. Once connected, any Facebook User who is able to perform Tasks on behalf of that Page will be able to grant your app a User access token, which you can then include in API requests.

I haven't heard of the Instagram Creator Account feature before, but Instagram's Help Article makes it seem like it's an additional product you have to request on your account.

[dalemartyn]

Hi @stevenschobert

Yeah I saw on the IG User page after I posted that you need have (or change to) a business or creator account. I think you then have to link your account to a facebook page before you can use the facebook api. I gave up at that point as I didn't have the facebook log in for the client I was trying to set it up for, but I think it should be doable now with either a creator or business account, so long as you have a facebook page. Hopefully they remove that limitation in the future.

[KarolinaKropka]

How i can get on my website (only code html, css, js): "Getting images from your user account" ?
should be in:

<script type = "text/javascript" src = "js/instafeed.min.js"> </script>
next:

<!--INSTAFEED.JS-->
<div class="container" id="insta">
<div id="instafeed"></div>
</div>
<script type="text/javascript">
    var userFeed = new Instafeed({
  get: '****',
  userId: ****,
  accessToken: '****'
});
userFeed.run();
</script>

Pls help me.
and one more question. When i put on them, in 2020 it isnt work?
my IG accound is add to FB page.

[derrickwod]

I'm a little confused with the above posts as I've set up a page and 5/7 hashtags are working.
Does anyone have any advice?

https://featherstonehomes.co.uk/sites.php

[benjamin-hull]

Hi @derrickwod - what you're seeing is using the remaining "get my own posts" behaviour, with the filter by tag done as a second step. You can't fetch directly by tag anymore "show me all public posts tagged with x".

The reason you won't see all of the tags work - or at least, how well they work, if at all - is because the API will only give you your (IIRC) 20 most recent posts. If none of those posts have the tag you're filtering by, you'll end up with no posts in your filtered set.

[panakour]

take a look at https://github.com/jsanahuja/jquery.instagramFeed its working without using the instagram API

[benjamin-hull]

@panakour - That's ... surprising! It's basically a web-scraper in Javascript, and works because IG's web endpoints are setting a CORS Access-Control-Allow-Origin header on the response which matches any Origin header you send. A couple of thoughts on that:

• That's an interesting/odd policy for something like IG. Ordinarily, a request like this would be blocked - javascript on a website can only request from it's own domain (the same-origin policy), or a host which sets that Access-Control-Allow-Origin header to allow the domain. The fact that IG appears to be allowing any origin suggests they're deliberately allowing this behaviour. I tested with an origin of "Blah Blah" and it worked - it doesn't need to even be a domain. Is this intentional? Accidental? Who knows - it's definitely not common though. To compare, facebook.com doesn't have this policy.

• The fact that this is undocumented (AFAICT) gives it unknown reliability. If IG's CORS policy ever changes, everything relying on this will stop working without warning.

• The fact that it's scraping the returned HTML makes it much less reliable. A scraper must make assumptions about the contents of the page it's scraping. For instance, this script relies on the string window._sharedData = appearing in the page exactly. If IG ever change this (even adding or removing a space), this will stop working without warning.

Personally, I wouldn't rely on this for anything critical in production. At least with the API changeover, there's a published plan to refer to. That said, it is a neat solution to the problem, and the library itself looks well written and high quality at first glance.

[benjamin-hull]

Instafeed v2 now supports the new Basic Display API. Thanks for all the helpful feedback, folks!