OAuth 2.0 integration
Socialift gives the OAuth 2.0 flow for Instagram, Facebook, LinkedIn and TikTok one consistent pattern: every client has login_url() and exchange_code() (the Meta clients return a long-lived token straight away), Facebook adds pages() for Page tokens, and refresh and revoke exist wherever the platform supports them. Error classes are the same everywhere. Telegram does not use OAuth — it connects with a phone number and code, or a bot token.
Updated:
How does OAuth 2.0 work on social platforms?
OAuth 2.0 is the authorisation standard that grants an application specific rights without handing over the user's password. The user is sent to the platform's consent screen, approves it, a one-time code returns to your address, and you exchange that code for an access token.
Inside Meta's ecosystem the chain is longer: a short-lived token is exchanged for a long-lived one, the user's Pages are read from it, each Page issues its own Page token, and working with Instagram means locating the Instagram account ID linked to that Page. With Instagram Login (no Page) the chain is shorter: the code becomes a 60-day Instagram user token, which can be extended for another 60 days with refresh_token() once it is at least 24 hours old.
On LinkedIn the flow is Sign In with LinkedIn using OpenID Connect (openid profile email) plus w_member_social for posting; the access token lasts 60 days, and refresh tokens are issued only to approved Marketing Developer Platform partners — everyone else signs in again. With TikTok Login Kit the access token lives 24 hours and the refresh token 365 days; a refresh may return a new refresh token, so always store the value from the latest response. Socialift keeps the calls uniform; the lifetimes are the platforms' rules.
Exchanging the code for a token
import asyncio
from socialift import Facebook
async def main(code: str):
# FACEBOOK_APP_ID, FACEBOOK_APP_SECRET, SOCIALIFT_LICENSE_KEY
async with Facebook.from_env() as fb:
token = await fb.exchange_code(code, redirect_uri="https://your-domain/cb")
for page in await fb.pages(token.access_token):
print(page.name, "→ instagram:", page.instagram_username)
asyncio.run(main(code="...")) # ?code= from the OAuth callbackUpgrading to a long-lived token and fetching Page tokens happen inside the same flow.
What you get out of the box
Authorisation URL
A correctly built URL with the right scopes, per platform.
Token lifecycle
Exchange for long-lived tokens, expiry checks via TokenBundle.expires_at and is_expiring(); revocation with revoke() on Facebook and TikTok.
Page tokens
The user's Pages and the Instagram accounts linked to them in one call.
Unified errors
AuthError when access is revoked, RateLimitError when limits are hit — identical across platforms.
TikTok tokens
Login Kit flow: 24-hour access token and 365-day refresh token; a refresh may return a new refresh token, so store the latest value returned by refresh_token().
Telegram without OAuth
An account connects with a phone number, code and 2FA password; a bot with its BotFather token.
Implementing OAuth safely
- Use the state parameter and bind it to the session — CSRF protection.
- redirect_uri must match the value in the Meta, LinkedIn or TikTok console exactly. If you add your own app keys on the “Kalitlar” (Keys) page of the dashboard, the exact redirect URL is shown there.
- Store tokens encrypted and keep them out of your logs.
- Track token expiry ahead of time and prompt the user to reconnect.
- Request only the scopes you genuinely need — extras make App Review harder.
Frequently asked questions
How long does a long-lived token last?
Meta long-lived user tokens last about 60 days; Instagram Login tokens also last 60 days and can be extended with refresh_token() once they are at least 24 hours old. Page tokens obtained from a long-lived user token have no fixed expiry. A password change or revoked permission invalidates tokens immediately, so keep a reconnect flow ready.
What is the difference between a Page token and a user token?
A user token acts on behalf of a person and lets you list their Pages. A Page token acts on behalf of one specific Page — when Instagram is connected through a Facebook Page (Instagram.via_facebook), Direct and publishing use it. With Instagram Login there is no Page: the Instagram user token is used instead.
What happens when a user revokes access?
The next call returns an AuthError. The right behaviour is to mark the connection as broken and show the user a re-login link.
Does Telegram connect through OAuth too?
No. A Telegram account connects with a phone number, the code Telegram sends and, if enabled, the 2FA password; a bot connects with the token from BotFather. Both options live on the “Ulanishlar” (Connections) page of the dashboard, and tokens are stored encrypted on the server and never sent to the browser.