Instafeed – Multi-Tenant Instagram Feed API & Embeddable Widget

February 15, 2026

Delivery snapshot

Record date: February 15, 2026. Technology and screenshots describe the delivered version documented on this date. Any performance observations belong to the same point-in-time record. The linked live site may include later changes made by the client or other providers.

Overview

Instafeed is a self-hosted Instagram feed aggregator built to replace paid third-party embed services across agency client sites. The platform provisions each client with a unique API key, manages Instagram OAuth authentication on their behalf, and exposes a clean public JSON endpoint that any website can consume, no secret keys exposed to the client. Running as a Cloudflare Worker at the edge, Instafeed delivers sub-100ms response times globally while caching feed results for one hour to avoid Instagram rate limits. A companion embed script (/embed.js?client=slug) turns any static site into an Instagram showcase with zero frontend dependencies.

Key Features

Multi-Tenant Client Provisioning

Each client receives a unique slug, API key, and invitation token. The admin dashboard manages the full client lifecycle: creation, token assignment, API key rotation, and removal. Client data is stored in a Cloudflare D1 database with AES-GCM encrypted Instagram access tokens.

Instagram OAuth Flow

Clients authenticate via a dedicated /connect portal where they grant the app access to their Instagram Business or Creator account. Tokens are encrypted at rest using an ENCRYPTION_KEY secret and automatically refreshed via a daily cron job before expiration.

Public Feed API

The /feed/:slug endpoint returns normalized post data, images, videos, captions, timestamps, filtered for client-specific needs. Responses are cached in Cloudflare KV for one hour, with X-Cache: HIT/MISS headers for debugging. No Instagram secrets are ever exposed to the client.

The /embed.js?client=slug script delivers a drop-in component. Usage is simple: <div data-instafeed="client-slug"></div>. The widget renders a responsive grid of recent posts with optional lightbox expansion, entirely client-side with no build step required.

Automated Token Refresh

A scheduled Cloudflare Worker cron job runs daily at 8 AM UTC, identifying all tokens expiring within 10 days and refreshing them via the Instagram Graph API. This ensures zero manual intervention and no sudden feed outages.

Admin Invitation System

Admins generate time-limited invitation links (48-hour expiry) for new clients. Each invitation emails a branded HTML template with a setup link. The flow guides clients through OAuth, API key generation, and embed snippet delivery.

Meta App Review Compliance

The platform includes mandatory /privacy and /data-deletion routes required by Meta for Instagram API access. These endpoints fulfill the app review requirements for public Instagram feed access.

Technologies Used

Cloudflare Workers – Edge runtime with global distribution
Hono v4 – Lightweight TypeScript framework with built-in middleware
Cloudflare D1 – SQLite at the edge for tenant data
Cloudflare KV – High-performance cache for feed responses
AES-GCM Encryption – Token security at rest
Meta Instagram Graph API – Source of feed data
Wrangler v4 – Deployment and secret management

Challenges & Solutions

Keeping tokens secure
Instagram access tokens are valuable and must never be exposed. Every token is encrypted with AES-GCM using a per-environment ENCRYPTION_KEY before storage in D1. The decryption happens only at request time, immediately before calling Instagram's API. Avoiding Instagram rate limits
Frequent feed requests trigger Instagram's rate limiting. Implemented one-hour KV caching with intelligent invalidation. The X-Cache headers let us verify cache hits in development. Managing OAuth complexity
The OAuth flow involves multiple steps: authorization, token exchange, long-lived token conversion, and encryption. Built a self-service portal that guides clients through each step with minimal friction.

Impact

Eliminated third-party embed costs across 5+ client sites
Sub-100ms global latency via Cloudflare edge deployment
Zero manual token management through automated refresh
Self-sustaining platform requiring no ongoing maintenance beyond occasional Meta app review renewals
Consistent branding on client sites with a custom embeddable widget

Live Site

instafeed.apalaugonzalez.com