Authentication

Introduction

Feedframer authenticates requests with an API key. Each connected Instagram account has its own key, and that key reads only that account's posts and profile. The key goes in the api_key query parameter of every request.

The system is deliberately simple because the API is read-only and serves posts that are already public on Instagram.

API keys

Find your API key

1. Log in and open your Dashboard.
2. Find the card for the Instagram account you want to use.
3. Copy the value labelled Feedframer API Token, using the copy button next to it.

Feedframer creates the key when you connect the Instagram account. The key doesn't expire.

The same card also has an Instagram Access Token field, hidden until you reveal it. That's Feedframer's token for Instagram's own API. It is not your Feedframer API key and doesn't work with the Feedframer API.

Key format

A key is 64 characters long and contains only the digits 0–9 and lowercase letters a–f:

3f9a1c7e5b2d4f6a8c0e1b3d5f7a9c2e4b6d8f0a1c3e5b7d9f2a4c6e8b0d1f3a

The examples in these docs use YOUR_API_KEY in its place.

One key per Instagram account

• Each connected Instagram account has one key.
• A key only reads its own account. There's no way to read another account's posts with it.
• If you connect several Instagram accounts (Premium allows up to 5), each has its own key. Use each account's key to read that account.

Making authenticated requests

Add api_key=YOUR_API_KEY to the query string of every request. This is the same for the REST API, the RSS feed and the GraphQL API.

REST API:

curl 'https://feedframer.com/api/v1/me?api_key=YOUR_API_KEY'

RSS feed:

curl 'https://feedframer.com/api/v1/rss?api_key=YOUR_API_KEY'

GraphQL API:

curl -X POST 'https://feedframer.com/graphql?api_key=YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"query": "{ me { username } }"}'

Feedframer only reads the key from the query string. Keys sent in a header, such as Authorization: Bearer ... or X-API-Key, are ignored, and the request fails with MISSING_API_KEY.

Code examples

Each example fetches your profile and posts and stops with the error code if the key is missing or wrong.

JavaScript

const apiKey = 'YOUR_API_KEY';
const url = `https://feedframer.com/api/v1/me?api_key=${apiKey}`;

const response = await fetch(url);
const body = await response.json();

if (!response.ok) {
  const error = body.errors[0];
  throw new Error(`${error.code}: ${error.detail}`);
}

console.log(`@${body.username}: ${body.posts.length} posts`);

This works in the browser and in Node.js 18 or later. In a browser <script>, add type="module" so await works at the top level.

PHP

<?php

$apiKey = 'YOUR_API_KEY';
$url = 'https://feedframer.com/api/v1/me?' . http_build_query(['api_key' => $apiKey]);

// ignore_errors lets us read the JSON body of 4xx and 5xx responses too.
$context = stream_context_create(['http' => ['ignore_errors' => true]]);
$response = file_get_contents($url, false, $context);
$body = json_decode($response, true);

if (isset($body['errors'])) {
    $error = $body['errors'][0];
    throw new RuntimeException("{$error['code']}: {$error['detail']}");
}

echo "@{$body['username']}: " . count($body['posts']) . " posts\n";

Python

import requests

api_key = 'YOUR_API_KEY'

response = requests.get(
    'https://feedframer.com/api/v1/me',
    params={'api_key': api_key},
    timeout=10,
)
body = response.json()

if not response.ok:
    error = body['errors'][0]
    raise RuntimeError(f"{error['code']}: {error['detail']}")

print(f"@{body['username']}: {len(body['posts'])} posts")

Using your key in the browser

You can use your API key in client-side code. It's fine in frontend JavaScript, in a static site, or in a public code repository.

That's safe because the key:

• only reads, and can't change anything on Feedframer or Instagram
• only reads one Instagram account's posts and profile, which are already public on Instagram
• can't access your Feedframer login, billing or settings

Feedframer has no rate limits, so someone else using your key can't use up an allowance.

The REST API, RSS feed and GraphQL API all send CORS headers that allow any origin, so you can call them from a web page on any domain without a proxy:

fetch('https://feedframer.com/api/v1/me?api_key=YOUR_API_KEY')
  .then((response) => response.json())
  .then((body) => console.log(body.posts));

If you'd still rather keep a key private, call Feedframer from your server and pass the posts on to the browser.

Regenerate your API key

To replace a key, for example if you no longer want an old copy of it to work:

1. On the Dashboard, click Regenerate next to the account's Feedframer API Token.
2. A dialog warns that the current token stops working straight away. Click Regenerate Token to confirm, or Cancel to keep the current key.

When you confirm:

• The account gets a new key, shown on its card.
• The old key stops working immediately. Requests that use it return HTTP 401 with INVALID_API_KEY.
• Cached responses for the account are cleared, so the old key can't be served from the cache either.

Any website, app or RSS integration that uses the old key stops showing posts until you update it with the new one.

When a key changes

Connecting Instagram covers reconnecting and disconnecting in more detail.

Authentication errors

A request with a missing or unknown key returns HTTP 401. The body follows the JSON:API error format and has the Content-Type application/vnd.api+json, whatever Accept header you send. GraphQL requests get the same 401 response, not a GraphQL error.

Missing API key

The request has no api_key query parameter.

{
  "errors": [
    {
      "status": "401",
      "code": "MISSING_API_KEY",
      "title": "Authentication Required",
      "detail": "An API key is required. Please provide your API key using the api_key parameter."
    }
  ]
}

Fix: add ?api_key=YOUR_API_KEY to the URL. Remember that headers aren't read.

Invalid API key

The key isn't recognised. That happens when it was mistyped or cut short, when it was regenerated, or when its Instagram account was disconnected.

{
  "errors": [
    {
      "status": "401",
      "code": "INVALID_API_KEY",
      "title": "Authentication Failed",
      "detail": "The provided API key is invalid."
    }
  ]
}

Fix: copy the current key from the account's card on the Dashboard. If the account isn't listed there, connect it again; it will have a new key.

For all other error codes, see Error Handling.

Testing authentication

When you're logged in, the API Playground and the GraphQL Explorer send requests with your own key, so you can check a key works without writing code.

Next steps

• REST API reference
• GraphQL API reference
• Caching & Performance
• Error Handling