Skip to content

Instagram Access Token

Service Name: Instagram (Meta)

Service Description: Instagram is a photo and video sharing social networking service owned by Meta Platforms that allows users to share content, follow others, and engage with posts through likes and comments.

Service Address: https://www.instagram.com/

Validation Type: API Auth

IP Allow list: Does not exist at the token level, but Meta Business accounts can set up IP restrictions at the account level.

Secret Access Scope: Grants programmatic access to Instagram APIs, allowing applications to interact with Instagram features, access user data, post content, and manage accounts based on the permissions granted during authorization.

Secret Revokement URL: https://www.instagram.com/accounts/manage_access/

Secret Example: IGQVJYeUk4YWNFWU1HbGJZAWjQtT0hHZA3ZALWlJVUJoRUQ5UmxkaGRiZACZBZAUDZB3UF95NF8xdGxfZA3cwZDZD

Suspicious Activity Investigation Instructions:

  • Review the Instagram account's activity log for unauthorized posts or actions.
  • Check for unknown applications connected to the Instagram account in the "Apps and Websites" section.
  • Monitor for unusual login locations or devices in the security settings.
  • Review API call logs if available through Meta for Business.
  • Check for unexpected changes to account settings or profile information.

Mitigation Instructions:

  • Immediately revoke the compromised access token through Instagram account settings.
  • Navigate to Instagram.com > Profile > Settings > Apps and Websites.
  • Remove any suspicious third-party applications.
  • Change the Instagram account password to invalidate all existing sessions.
  • Enable two-factor authentication if not already enabled.
  • Generate new access tokens for legitimate applications that need access.
  • Review and limit the permissions granted to third-party applications.
  • Consider using short-lived tokens instead of long-lived tokens for better security.