Instafeed.js: Hide access token?

[heymATIN]

Not sure if this is an issue or a Request,.. anyway.

I wanted to pull the profile picture only to my website by using this code:

$(document).ready(function() {
  var userFeed = new Instafeed({
     target: 'u-ava',
     limit: 1,
     get: 'user',
     userId: 'user_id',
     accessToken: 'user_Token',
     template: '<img class="u-avatar center-block"src="{{model.user.profile_picture}}" />',
     });
  userFeed.run();
});

It worked like a charm. My concern: How do I hide the access token on the website? You shouldn't be able to read that information so easy, at best - not reading it at all..

I also thought about trying to use the clientId instead of the accessToken which sadly didnt work for me.

What can I do for safety of hiding the access token, or any other methods of calling the profile picture of the user without the accessToken ?

[vncscoelho]

A lot of people (including myself) have asked this question, but I think the best answer is: https://github.com/stevenschobert/instafeed.js/issues/382#issuecomment-208616001

I think the only risk in exposing your access token would be that someone could find it and use it for their own app, but if your access token has only been granted basic permissions, then they would only be able to display the 20 most recent photos from your Instagram account. I can't imagine anyone would want to do that. As long as you stay in sandbox mode, your client ID and access token are virtually useless to anybody else.

Even if you get approved for production use, as long as you only authenticate users for basic permissions, exposing their access tokens to the client wouldn't give anyone API access to information that isn't already publicly available or beyond the scope of that specific account.

With that in mind, you should never expose an access token that has anything beyond basic permissions if it is an account that you care about.

With that in mind, I wouldn't care exposing the access token if you just want it to display photos.

[vm6ej04]

Thanks @vncscoelho ! I was searching the same question.

[yilaa]

Thanks, i had the same question.

[stale[bot]]

This issue has been automatically marked as stale because it hasn't had new comments in the last 3 months. It will be closed if no further activity occurs. If you still need assistance with this issue, or believe it shouldn't be closed, please respond with a new comment to let us know.
Thank you all for your contributions.