6 ms·
In your post, you state that Instagram does not use OAuth. But then, you link to their API page. First sentence I read was: "Instagram’s API uses the OAuth 2.0
by dutchbrit 14y ago
In your post, you state that Instagram does not use OAuth. But then, you link to their API page.
First sentence I read was: "Instagram’s API uses the OAuth 2.0 protocol for simple, but effective authentication and authorization."
- AshFurrow 14y agoThey offer different authentication mechanisms depending on whether you're writing a client or web app.
- ceejayoz 14y agoCan you point to anywhere that documents that? "Instagram’s API uses the OAuth 2.0 protocol for simple, but effective authentication and authorization." seems pretty clear. So's this bit: > Client-Side (Implicit) Authentication > If you’re building an app that does not have a server component (a purely javascript app, for instance), you’ll notice that it’s impossible to complete step three above to receive your access_token without also having to ship your client secret. You should never ship your client secret onto devices you don’t control. Then how do you get an access_token? Well the smart folks in charge of the OAuth 2.0 spec anticipated this problem and created the Implicit Authentication Flow.