5 ms·

"Don't store or cache Instagram login credentials." So, a app needs to ask for a login and password each time it access Instagram?

doomrobo 10y ago
Well that's just good practice. Apps would normally ask you to log in once, receive an API token from the server, and continue to use that for the rest of the tokens lifetime. When the token expires, it'll prompt you again for your login.
- protomyth 10y ago
  We don't do that with web browsers these days. I get the feeling other apps on my PC (particularly a photo or video editor that had a "Share" function for Instagram) it would get tiresome.
  - prdonahue 10y ago
    Sure we do. See also: bearer tokens.
    - protomyth 10y ago
      Look at password management in browsers, that's what I meant. No one bans browsers from accessing their site.
- techdetect 10y ago
  Sure but consider that every endpoint in the API needs a login. That means that you can no longer construct a simple feed widget of a hashtag for your website.
  - doomrobo 10y ago
    Oh, I didn't see that part. That's a lot more inconvenient.
ruffrey 10y ago
often there is some kind of token you can snag which will last for a decent amount of time. I can't speak to the Instagram API though.
- xuki 10y ago
  It lasts until you revoke the app or change your password.
  - protomyth 10y ago
    ok, that makes more sense - thanks
theDoug 10y ago
No… it could store a session token.
f3llowtraveler 10y ago
There's no need to store the credentials -- you can just ask the Apple keychain to store them instead.
ceejayoz 10y ago
No, an app is explicitly forbidden from ever asking for login/password. Twitter/Facebook do the same thing. Instead, you use OAuth to fetch an access token. This is far better for the user - they can revoke your app's access without changing passwords, and without all their other apps losing their connections.

5 ms·

"Don't store or cache Instagram login credentials." So, a app needs to ask for a login and password each time it access Instagram?

by protomyth 10y ago

doomrobo 10y ago
Well that's just good practice. Apps would normally ask you to log in once, receive an API token from the server, and continue to use that for the rest of the tokens lifetime. When the token expires, it'll prompt you again for your login.
- protomyth 10y ago
  We don't do that with web browsers these days. I get the feeling other apps on my PC (particularly a photo or video editor that had a "Share" function for Instagram) it would get tiresome.
  - prdonahue 10y ago
    Sure we do. See also: bearer tokens.
    - protomyth 10y ago
      Look at password management in browsers, that's what I meant. No one bans browsers from accessing their site.
- techdetect 10y ago
  Sure but consider that every endpoint in the API needs a login. That means that you can no longer construct a simple feed widget of a hashtag for your website.
  - doomrobo 10y ago
    Oh, I didn't see that part. That's a lot more inconvenient.
ruffrey 10y ago
often there is some kind of token you can snag which will last for a decent amount of time. I can't speak to the Instagram API though.
- xuki 10y ago
  It lasts until you revoke the app or change your password.
  - protomyth 10y ago
    ok, that makes more sense - thanks
theDoug 10y ago
No… it could store a session token.
f3llowtraveler 10y ago
There's no need to store the credentials -- you can just ask the Apple keychain to store them instead.
ceejayoz 10y ago
No, an app is explicitly forbidden from ever asking for login/password. Twitter/Facebook do the same thing. Instead, you use OAuth to fetch an access token. This is far better for the user - they can revoke your app's access without changing passwords, and without all their other apps losing their connections.