Instagram access token to retrieve any user feed

Question

Is it normal that I can get any users feed with the same access_token? Here are two examples. The first is from the test account, it is what I should have access to. And the second one is from the ImagineDragons's instagram feed.

https://api.instagram.com/v1/users/510573486/media/recent?access_token=510573486.ab7d4b6.d8b155be5d1a47c78f72616b4d942e8d

https://api.instagram.com/v1/users/20282699/media/recent?access_token=510573486.ab7d4b6.d8b155be5d1a47c78f72616b4d942e8d

If so, why do I have to request an access_token in order to do the request?

Answer 1

Most apis work like this. Even though you are requesting public data (ie Imagine Dragon's instagram feed) they want to know who is making the request. They are probably tracking it to make sure no one is making a billion calls a day or something.

Answer 2

According to: Instagram Developer Documentation

The API call you are trying to make requires an access_token at all times. This is usually done to prevent bots which continously crawl through recent lists to fetch images and such. The only way Instagram could prevent this is via this access_token approach. Once you have the token, you are able to browse through any user's feeds as you would be able to do it on the webpage of the respective user. If you don't want the user to login to see a certain recent list, you could register a dummy account with Instagram, log that in once, and store its access_token, bundle it with your application and you will be able to request the recent feed without prompting the user to login. I am sure that this isn't an accepted way of solving this problem, mainly because according to the documentation the access_token might change at anytime, making your application nonfunctional. Of course, there are solutions even to this scenario. To summarize, I think if you want to request such a data without an access_token, try my 'solution'.

Answer 3

The token is required so the API cannot be accessed anonymously. Instagram photos are public unless the user has explicitly set their account to be private. Therefore, it is normal to be able to access the feeds of any public user account with a single valid token.

A token does not circumvent users' settings. If you try to access an account that is marked private you won't get any results and instead receive this response:

{"meta":{"error_type":"APINotAllowedError","code":400,"error_message":"you cannot view this resource"}}