使用Instagram API进行原生登录

Question

I've been working on an app for IG, and was looking at other websites which use the IG API. I came across this website which allows the user to login by entering their username and password directly into the site. It is then able to access the IG API and fetch things like follower count, however without the user authenticating an IG API Client as would normally be required. The app can even perform functions such as liking pictures using your account, which as far as I know also requires you to authenticate an app with elevated privileges.

My question is, how is this app able to login users without using OAUTH which appears to be the only method of authentication?

Answer 1

They probably use a web automation framework like Selenium to take actions like auto-linking content by actually logging in to the Instagram web site with the accounts credentials and simulating mouse clicks, etc. to get the job done. In other words their "script" just looks like a very active user to Instagram because it's all coming from interactions between a web browser and their site.

They definitely are not using the API. Several reasons you can know this:

1. no OAuth flow to get an access_token
2. they don't appear in the authorized applications section if you log in and manage your profile
3. what they are doing is a violation of the API Terms of Use. See the following under "shall not"

Use the Instagram APIs to post automated content to Instagram, including likes and comments that were not initiated and entered by an Instagram user.

I'm no lawyer and I have no inside information, however it seems clear enough to me that Instagram does not want this type of "bot" activity.

They claim that they have the timing set up in a way that they go undetected, but I think it's a safe bet that there are algorithms at Instagram trying to detect and prevent this type of activity and if they do, accounts would be at risk of being disabled, etc. I have not inside knowledge here, just speculation.