In order to work with the Instagram API, sooner or later, you must find your way through the nebulous API client registration and authorization process. Understanding the API access limitations can prevent a lot of wasted time, because they often result in unexpected data rather than straight-forward authentication errors that are easier to diagnose.On June 1 2016, console errors lit up all over https://kvisit.com/Q5BU/3fve0g,1,Ar2jr3Jo13GS8LSLFgYhWNSKD6ecT0hg-ACU6ZRz2hQ the world when Instagram significantly restricted access to its API. The first thing to understand is that it was a deliberate business decision by Instagram, designed to prevent their API from being used for a variety of purposes. Understanding this fact will not fix the errors in the console, but it makes the restrictions more intuitive to work around if you understand their intent.
The gatekeeper between developers and full API access is called sandbox mode. The documentation presents it as a temporary step in the development process, but the overwhelming majority of projects will never leave sandbox mode because Instagram only grants full access to their API for a handful of very specific use cases:
- “My app allows people to login with Instagram and share their own content”
- “My product helps brands and advertisers understand, manage their audience and media rights.”
- “My product helps broadcasters and publishers discover content, get digital rights to media, and share media with proper attribution.”
If you cannot convince the Instagram lords that your app serves one of these specific purposes, it will be rejected if you submit it to “Go live”. For this reason, it may be more intuitive to think of it as “sideline mode.
Sandbox mode means that your API calls go to a magic island where only your last 20 posts exist. That’s it. No one else exists on the island, so you will not see results for anything you posted earlier, or from any other Instagram users, even if that content is public. You can invite additional “sandbox users” which will add them to your magic island, but just like you, only their most recent 20 posts exist on the island.
One of the most common confusions about the new restrictions is conflating scopes and sandbox mode. Sandbox mode governs what your API requests can “see” diverting them to the magic island. Scopes govern what a specific token can and cannot be used for. Every token automatically starts with the
basic scope. A token with only the
basic scope can do very little, whether in sandbox mode or live. To view even public content, you will need to request the additional
public_content scope. Where sandbox mode enters the picture is in determining what is included in “public content”. In sandbox mode, it will only include the posts on the magic island, whereas a live app can see anything that’s public (in the real world) on Instagram.
The most common misconception is that an app needs to be approved to "go live” in order to request scopes. This is incorrect. For example, while in sandbox mode, you need a token with the
public_content scope to see posts by your other sandbox users just the same way approved (“live”) apps do. Technically there is nothing a live app can do that cannot be done in sandbox mode, as long as it only involves users and content that lives on the magic island.
It is also worth mentioning that before June 2016 many API calls used to allow authentication with only a
client_id from a registered client. Now all requests require an
access_token. However there are still lots of plugins, documentation, and tutorials from before June 1 that have yet to update accordingly.
Part Two will show how to work within the API restrictions to set up the popular Instagram integrations that are still possible in sandbox mode. As discussed above, you will need to generate a token to authenticate requests to the Instagram API. There are basically two ways to do this: you can request tokens programmatically or manually. Both approaches require you to have first registered an Free Followers On Instagram API client (described above). Before the June 2016 restrictions kicked in, there were many resources like this to choose from, but you will find that many of them broke when the restrictions started. InstagramToken.com still works, and it also allows you to generate tokens with specific scopes (explained in Part One) which is important if you are trying to do anything besides request your own content.