Instagram access token to retrieve any user feed

Question

Is it normal that I can get any users feed with the same access_token? Here are two examples. The first is from the test account, it is what I should have access to. And the second one is from the ImagineDragons's instagram feed.

https://api.instagram.com/v1/users/510573486/media/recent?access_token=510573486.ab7d4b6.d8b155be5d1a47c78f72616b4d942e8d

https://api.instagram.com/v1/users/20282699/media/recent?access_token=510573486.ab7d4b6.d8b155be5d1a47c78f72616b4d942e8d

If so, why do I have to request an access_token in order to do the request?

Solution

The token is required so the API cannot be accessed anonymously. Instagram photos are public unless the user has explicitly set their account to be private. Therefore, it is normal to be able to access the feeds of any public user account with a single valid token.

A token does not circumvent users' settings. If you try to access an account that is marked private you won't get any results and instead receive this response:

{"meta":{"error_type":"APINotAllowedError","code":400,"error_message":"you cannot view this resource"}}

Comments

[David]

Thanks a lot, I didn't know you could have a private account Instagram account. This make sense now.

[David]

I knew all this. I was wondering why with a single access_token I could gather any users feed. The private accound make sens know. Plus a simple bot could crwal pages from around the www to find such access_token in websites that makes theses javascript request. The token is right in the GET request.

[akshay2000]

This is not entirely true. Most APIs do require a client id which can identify which app is making the request. Access tokens are used to identify which user is trying to make the request.