Open OAuth tools

Social / Content

Meta (Facebook/Instagram) OAuth

Instagram long-lived token flow has provider-specific endpoints; use dedicated Instagram routes in this app.

Automated OAuth formProvider docs

What this workflow can do

  • Build authorization URL
  • Exchange authorization code
  • Refresh token
  • Verify access token

Before starting

  • Client ID
  • Client secret
  • Redirect URI
  • Scopes
  • PKCE only if your app requires it
  • Callback code and state

Result handling

  • Access token returns from exchange and can be verified in the result panel.
  • Refresh token may return from exchange or refresh.
  • Callback state is only used to validate the current handshake.
  • Anonymous OAuth Hub workflows do not store client secrets, authorization codes, access tokens, or refresh tokens.
  1. 01PrepareEnter provider credentials, scopes, callback details, and PKCE values if required.
  2. 02AuthorizeBuild the authorization URL and open provider consent.
  3. 03ExchangePaste the returned code and state, then exchange them for tokens.
  4. 04VerifyTest the access token against the provider verification endpoint.
  5. 05Next stepsCopy tokens or metadata, then store them safely outside anonymous mode.

Credentials

OAuth handshake

Provider callback returns code and state. Refresh uses refresh_token.

Troubleshooting

  • Instagram long-lived token exchange uses Graph Instagram endpoints and differs from standard Meta user token flow.
  • Expired long-lived tokens must be replaced with a new exchange before refresh can resume.

Provider checklist

  1. For Instagram carousel use this app's dedicated Instagram exchange/refresh routes.
  2. Store long-lived token in backend secret storage and not in client code.
  3. Schedule refresh approximately every 50 days to avoid 60-day expiry outages.
  4. Retest feed endpoint after secret updates to confirm live media retrieval.