How to verify instagram credentials

Hi BHW,

I have a website where users will enter in their instagram credentials and I will kick off a bot for them. An issue that seems to be re-occurring is that users are entering the incorrect password. Is their a way I can validate their credentials before passing the parameters to my software. I would like to be able to do this via php, javascript or any other web language, built into my form validation.

I looked into their oath 2.0 for instagram, but every call to their api has to have the user login themselves, and they give me an access token. I want to save the user time and I don't want their access token because they are not using an API I built.

I could use a webdriver to login to a 3rd party instagram site and scrape information that would validate it completed its login. I really don't want to go this route because it wont be fast, I would have to boot the software up, wait for its results, which could easily take half a minute or more, does anyone have any good insight on the best possible way to do this?

Thanks!

Make a script that tries to log using the page not their api. Something like that in python. It is not working because I dont have time to find missing headers or cookies.

>>> import requests, re
>>> session = requests.session()
>>> payload = {'username':'niceusername','password':'123456'}
>>> session.get('https://instagram.com/')
<Response [200]>
>>> token = re.search('csrf_token":"(.*)"}', r.text).group(1)
>>> headers = {'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8', 'X-Requested-With':'XMLHttpRequest', 'X-Instagram-AJAX':'1', 'X-CSRFToken': token}
>>> session.post('https://instagram.com/accounts/login/ajax/', data=payload, headers=headers)
<Response [403]> #this is bad, try to figure out the missing cookies or header

Click to expand...

The downside with this method is everybody connects using the same ip, you costumers accounts might get flagged. Proxy won't really help, because if it's too far from the user usual behavior the account could get flagged for a second verification.

Your api could be kind of a middle man where you gather all the data you need/want. Not sure how it works in production and how it scales though.