Week 4 · Lesson 14

Instagram OAuth

Compliance-sensitive connect flow. Saving App ID ≠ connected. Real consent + token exchange.

Time · 1–2 days Compliance
Learn
  • OAuth consent → short-lived → long-lived token
  • Encrypt secrets at rest; redirect URI hygiene
  • Disconnect / revoke path; log auth events without raw tokens
Build
  1. OAuth initiate + callback endpoints
  2. Encrypt tokens in SQLite
  3. React connection status reflects real Graph auth
Checkpoint

Dashboard shows a real connected Business account; failures are loud, not silently “connected.”

Four notes
  • What problem does this layer solve?
  • What is allowed to call it?
  • What must it never do?
  • How do I observe and test it?