How DirectFa connects to Instagram

We never ask for Instagram credentials

DirectFa does not display, imitate, proxy or embed an Instagram login form at any point. There is no field anywhere on this site that accepts an Instagram username or password. Authorization happens entirely on instagram.com, under Instagram's own domain and TLS certificate, using the OAuth 2.0 authorization code flow published by Meta.

Authorization flow

1. A signed-in DirectFa user clicks "Connect account" in their dashboard. Our server issues a random CSRF state value, stores it in an httpOnly cookie, and returns the authorization URL as JSON.
2. The browser navigates to Instagram's own consent screen at https://www.instagram.com/oauth/authorize. The user reviews and approves the requested scopes there, on Instagram's domain.
3. Instagram redirects back to our registered callback, https://directfa.com/api/connect/return, with a short-lived authorization code. We verify the state cookie to reject forged requests.
4. Server-side only, we exchange that code for a short-lived access token at api.instagram.com/oauth/access_token, then upgrade it to a 60-day token. The token never reaches the browser.
5. All subsequent API calls go to graph.instagram.com using that token, scoped strictly to the account the user authorized.

Permissions requested

• instagram_business_basic— read the connected account's public profile (username, avatar, follower count).
• instagram_business_manage_messages — send the automated direct message replies the user configured.
• instagram_business_manage_comments — read incoming comments and post the public replies the user configured.

We request no other scopes. The user can revoke access at any time from Instagram Settings → Apps and Websites, without contacting us.

Data we store

The connected account's public profile, the access token, the automation rules the user writes, and the resulting message logs. We publish a privacy policy and a data deletion process, and we implement Meta's deauthorize and data deletion callbacks so that removing our app from an Instagram account propagates to us automatically.