Instagram access token qanday olinadi va yangilanadi

Sizga qaysi Instagram token kerak?

Instagram token turlari va amal qilish muddati

Muddatsiz Page token ham ma'lum holatlarda bekor bo'lishi mumkin — pastdagi 190 xatosi subkodlari odatiy sabablarni ko'rsatadi.

Instagram Login: koddan uzoq muddatli token'gacha

1. 1

   Foydalanuvchini login oynasiga yuboring

   https://www.instagram.com/oauth/authorize manziliga client_id, redirect_uri, response_type=code, vergul bilan ajratilgan scope (masalan instagram_business_basic,instagram_business_manage_messages) va tasodifiy state qiymati bilan yo'naltiring.

2. 2

   Kodni qabul qiling

   Instagram redirect_uri ga ?code=... bilan qaytaradi; oxiridagi #_ kodning qismi emas, uni olib tashlang. Kod 1 soat amal qiladi va faqat bir marta ishlatiladi.

3. 3

   Qisqa muddatli token'ga almashtiring

   https://api.instagram.com/oauth/access_token ga POST so'rov bilan client_id, client_secret, grant_type=authorization_code, redirect_uri va code form maydonlarini yuboring. Javobda qisqa muddatli token, user_id va berilgan ruxsatlar keladi.

4. 4

   Uzoq muddatli token oling

   GET https://graph.instagram.com/access_token — grant_type=ig_exchange_token, client_secret va access_token bilan. expires_in taxminan 5 184 000 soniya, ya'ni 60 kun.

5. 5

   Muddati bilan saqlang

   Token'ni shifrlangan holda expires_at (hozirgi vaqt + expires_in) bilan birga saqlang — bu sana yangilash vazifasi uchun kerak bo'ladi.

Xuddi shu oqim Socialift SDK'da

import os
from socialift import Instagram

async def instagram_callback(code: str, state: str, expected_state: str) -> dict:
    if state != expected_state:
        raise ValueError("state mos kelmadi")  # CSRF himoyasi
    async with Instagram.from_env() as ig:
        bundle = await ig.exchange_code(code, redirect_uri=os.environ["IG_REDIRECT_URI"])
        profile = await ig.profile(bundle.access_token)
    return {
        "username": profile.username,
        "token": bundle.access_token,     # saqlashdan oldin shifrlang
        "expires_at": bundle.expires_at,  # taxminan 60 kundan keyin
    }

Instagram long-lived token qanday yangilanadi?

Token'larni avtomatik yangilash vazifasi

from datetime import datetime, timedelta, timezone
from socialift import AuthError, Instagram

async def refresh_instagram_tokens(accounts) -> None:
    soon = datetime.now(timezone.utc) + timedelta(days=10)
    async with Instagram.from_env() as ig:
        for acc in accounts:  # o'z bazangizdagi yozuvlar
            if acc.expires_at > soon:
                continue
            try:
                bundle = await ig.refresh_token(acc.token)
            except AuthError:
                acc.status = "reconnect_required"  # muddati tugagan yoki bekor qilingan
                continue
            acc.token, acc.expires_at = bundle.access_token, bundle.expires_at

Facebook Login: user token → Page token → Instagram akkaunt ID

1. 1

   Facebook orqali login

   Foydalanuvchini Facebook Login'dan o'tkazing (Business ilovalarda konfiguratsiya ID bilan) va instagram_basic, pages_show_list hamda kerakli imkoniyat ruxsatlarini so'rang.

2. 2

   Kodni almashtiring

   graph.facebook.com dagi GET /oauth/access_token — client_id, client_secret, redirect_uri va code bilan — bir necha soatda tugaydigan qisqa muddatli user token qaytaradi.

3. 3

   Uzoq muddatli user token oling

   Xuddi shu endpointni grant_type=fb_exchange_token, client_id, client_secret va fb_exchange_token bilan chaqiring. Natija odatda taxminan 60 kun amal qiladi.

4. 4

   Sahifalar va ularning token'lari

   Uzoq muddatli user token bilan GET /me/accounts foydalanuvchi MANAGE, CREATE_CONTENT, MODERATE yoki ADVERTISE vazifasiga ega sahifalarni access_token bilan qaytaradi. Shu yo'l bilan olingan Page token muddatsiz.

5. 5

   Instagram akkauntni toping

   GET /{page-id}?fields=instagram_business_account bog'langan Instagram professional akkaunt ID sini beradi. Barcha Instagram so'rovlarida aynan shu ID ishlatiladi.

6. 6

   Instagram endpointlarini chaqiring

   So'rovlarni Page token bilan graph.facebook.com/{version}/<IG_ID>/... manziliga yuboring.

Facebook Login oqimi SDK bilan

import os
from socialift import Facebook, Instagram

async def facebook_callback(code: str) -> list[dict]:
    async with Facebook.from_env() as fb:
        user = await fb.exchange_code(code, redirect_uri=os.environ["FB_REDIRECT_URI"])
        print("berilgan:", await fb.granted_scopes(user.access_token))
        pages = await fb.pages(user.access_token)

    accounts = [p for p in pages if p.instagram_id]
    async with Instagram.via_facebook(app_secret=os.environ["FACEBOOK_APP_SECRET"]) as ig:
        for page in accounts:
            profile = await ig.profile(page.access_token, ig_user_id=page.instagram_id)
            print(page.name, "->", profile.username)
    return [{"page_id": p.id, "ig_user_id": p.instagram_id, "page_token": p.access_token} for p in accounts]

Instagram access token'ni qanday tekshirish (debug) mumkin?

190 xatosi va boshqa token xatolari

Socialift SDK'da 190 va 102 kodlari AuthError, 10 va 200–299 kodlari PermissionError ko'taradi; ikkalasida ham Meta javobidagi code va subcode bor.

Instagram token'larini xavfsiz saqlash

Socialift kabinetining "Ulanishlar" bo'limida OAuth token'lari serverda shifrlanadi va brauzerga yuborilmaydi. O'z backend'ingizda ham shu qoidalarga amal qiling:

• ▸App secret va barcha token almashinuvlari faqat serverda — secret brauzer yoki mobil ilovaga hech qachon bormasin.
• ▸Token'larni bazada shifrlangan holda, har birining expires_at qiymati bilan saqlang.
• ▸Token'ni log yoki xato kuzatish tizimiga yozmang; o'rniga akkaunt ID va fbtrace_id yozing.
• ▸Har bir login uchun tasodifiy state yarating va callback'da solishtiring — bu CSRF'dan himoya.
• ▸AuthError ni vaqtinchalik xato emas, holat o'zgarishi (qayta ulash kerak) deb qabul qiling.
• ▸Foydalanuvchi uzilganda faqat yozuvni o'chirmang, Meta tomonida ham ruxsatni bekor qiling (Facebook Login uchun fb.revoke).