4

A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and the person(s) with the admin role can revoke those privileges.

Instagram on the otherhand, has a strict one username/one password access model.

Where content management can be abstracted using a tool like Buffer or Hootsuite (which allows content to be scheduled and queued via a desktop browser application), in order for someone to actually post to Instagram they need to use their phone, with the single username and password, to post the content.

This seems sketchy - a large organisation that is perhaps providing customer service via their instagram account, would need multiple people having access, and there's what to do when someone gets sick etc.

But if they all share the password - it seems a recipe for being locked out of your account, an employee going rogue etc.

Is there any literature around how large companies are dealing with this currently?

It seems that Instagram just doesn't lend itself to use by an organisation - and I'm wondering how organisations deal with this.

1
  • Privilege account management could be the way but perhaps overkill Apr 17 '18 at 14:27
5

Not a complete solution, but paid LastPass accounts (Premium, Family, Teams, or Enterprise) allow a group of individuals to share access to one or more groups of login objects. The text of the password does not need to be visible as the LastPass Extension handles the actual login.

The down side is that once logged into a site, a rogue user can modify anything that does not require the original password to change. For example, rogue user could change the contact e-mail address, then request a "password recovery".

On the bright side, if you stop trusting someone before they go rogue, you can simply stop sharing the object(s) with them instead of changing passwords. Not much, but it's something...

Edit: As AndrolGenhald says in comments, changing the PW may still have value.

2
  • I'm not sure how the LastPass extension handles logging in, but I would guess that it'd be trivial to reveal the password. Apr 17 '18 at 18:06
  • 3
    If it's something basic like just auto-filling the password without submitting the form all you have to do is change type="password" on the input. If it automatically submits the form you can still use your browser's network tab to log the request and view the data posted. Apr 17 '18 at 18:28
5

Easy: API.

You create a program that have the API key, and create users that will consume services on this API. Each user will have his own credentials on this program, and will only be able to consume the services specified by his profile.

So you can have a profile that can only delete comments, other can post comments and other can post/delete images. If one user goes rogue, he is limited by his profile, any action he takes will be logged by the API and the offending user can be found and penalized as management seems fit.

This way you can have one account, one password, one API key, and still have user isolation.

The downside is that the POST endpoint is private, and only accessible to selected partners. The business unit of Instagram can be contacted for more information.

3
0

It's not directly possible with Instagram alone, so there's two possibilities: either code some solution on your own or buy a 3rd party tool for that.

Here's an article Ultimate Guide to Setting Multi User Access for Instagram that compares two 3rd party tools: Buffer & Hootsuite. Both can be used for managing all social media access rights from a single tool, but they are quite expensive. Of course, now you have to trust a new company, but this solves the problem with a possibly rogue or careless employee.

3
  • @dwjohnston, Step 5 of the linked article states that you can assign either "Full Posting Access" or "Approval Required" access levels per user. Sounds like one person isn't required to approve all postings if they grant "Full Posting Access" to others. The article also states, "With [Buffer], you no longer have to share your Instagram usernames, emails, and passwords amongst your team. Each of your team members will have access to Instagram via a [Buffer] profile and hence, keeping your Instagram account safe." Those two points contradict your two comments, no?
    – Justin C
    Apr 17 '18 at 21:09
  • It turns out I was wrong with these comments. Instagram updated their API this year, and now Buffer and Hootsuite can post to instagram direct.
    – dwjohnston
    May 2 '18 at 9:55
  • That's what I thought. You could remove the outdated comments to save others from reading them, and possibly even repeal the downvote, if it was yours. :) May 2 '18 at 10:10
0

Ok, so it turns out that Instagram added content posting content with their API this year. Currently it's in a beta phase - but it looks like Hootsuite and Buffer support it - meaning that you no longer need to use the Buffer/Hootsuite mobile app to post to Instagram - it will be posted direct.

Buffer and Hootsuite have multi-user access, but those cost money - $99/month for Hootsuite.

If you do want to cheap out - you can share the Hootsuite password amongst the users. Not a great solution - but if someone does run away with the password - they don't actually have access to your instagram account. The posting access can easily be revoked by the person who has the Instagram credential.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.