I am building a static website with an Instagram feed and I came across a solution that utilizes Javascript to access API data for a single user. The method many are using is outlined in this blog post: Display Instagram Posts on a Webpage with Instafeed.js

My concern is that it exposes the access_token in the webpage source. I believe this would mean that anyone with this information could "impersonate" the Instagram user and have the same feed elsewhere without their knowledge. What methods are there to obfuscate sensitive information in the page source? Is SSL required as well?

  • 1
    It seems that it's their (your visitors') access_token, they have access to that already. Also, if your feed is public - you can just add "/media" to it to get the json format. Like: instagram.com/mhendrickx/media – ndrix Mar 16 '17 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.