Skip to content

Instagram Client Secret

Service Name: Instagram (Meta)

Service Description: Instagram is a photo and video sharing social networking service owned by Meta Platforms that allows users to upload media that can be edited with filters and organized by hashtags and geographical tagging.

Service Address: https://www.instagram.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the Meta for Developers app level

Secret Access Scope: Grants access to Instagram APIs for interacting with Instagram data, including user profiles, media, comments, and other Instagram platform features based on the permissions requested.

Secret Revokement URL: https://developers.facebook.com/apps/

Secret Example: 82a684a0e5d14ab3a8efa4b8c5f23f4c

Suspicious Activity Investigation Instructions:

  • Review the Meta for Developers dashboard for unusual API usage patterns
  • Check for unexpected app behavior or unauthorized data access
  • Monitor for changes in app settings or permissions
  • Review recent API calls and endpoints accessed
  • Check for unusual geographic access patterns to your Instagram app
  • Verify if there are any unexpected users or admins added to your developer account

Mitigation Instructions:

  • Log in to the Meta for Developers portal at https://developers.facebook.com/

  • Navigate to "My Apps" and select the Instagram app

  • Go to "App Settings" > "Basic"

  • Click "Reset Client Secret" to invalidate the current secret and generate a new

one

  • Update the client secret in all legitimate applications and services
  • Review and revoke any unnecessary app permissions
  • Consider implementing additional security measures like IP restrictions
  • Update webhook URLs if they've been compromised
  • Review and update authorized redirect URIs