Instafeed – Multi-Tenant Instagram Feed API & Embeddable Widget

February 15, 2026

Instafeed is a self-hosted Instagram feed aggregator built to replace paid third-party embed services across agency client sites. The platform provisions each client with a unique API key, manages Instagram OAuth authentication on their behalf, and exposes a clean public JSON endpoint that any website can consume, no secret keys exposed to the client.

Running as a Cloudflare Worker at the edge, Instafeed delivers sub-100ms response times globally while caching feed results for one hour to avoid Instagram rate limits. A companion embed script (/embed.js?client=slug) turns any static site into an Instagram showcase with zero frontend dependencies.

Each client receives a unique slug, API key, and invitation token. The admin dashboard manages the full client lifecycle: creation, token assignment, API key rotation, and removal. Client data is stored in a Cloudflare D1 database with AES-GCM encrypted Instagram access tokens.

Clients authenticate via a dedicated /connect portal where they grant the app access to their Instagram Business or Creator account. Tokens are encrypted at rest using an ENCRYPTION_KEY secret and automatically refreshed via a daily cron job before expiration.

The /feed/:slug endpoint returns normalized post data, images, videos, captions, timestamps, filtered for client-specific needs. Responses are cached in Cloudflare KV for one hour, with X-Cache: HIT/MISS headers for debugging. No Instagram secrets are ever exposed to the client.

The /embed.js?client=slug script delivers a drop-in component. Usage is simple: <div data-instafeed="client-slug"></div>. The widget renders a responsive grid of recent posts with optional lightbox expansion, entirely client-side with no build step required.

A scheduled Cloudflare Worker cron job runs daily at 8 AM UTC, identifying all tokens expiring within 10 days and refreshing them via the Instagram Graph API. This ensures zero manual intervention and no sudden feed outages.

Admins generate time-limited invitation links (48-hour expiry) for new clients. Each invitation emails a branded HTML template with a setup link. The flow guides clients through OAuth, API key generation, and embed snippet delivery.

The platform includes mandatory /privacy and /data-deletion routes required by Meta for Instagram API access. These endpoints fulfill the app review requirements for public Instagram feed access.

• Cloudflare Workers – Edge runtime with global distribution
• Hono v4 – Lightweight TypeScript framework with built-in middleware
• Cloudflare D1 – SQLite at the edge for tenant data
• Cloudflare KV – High-performance cache for feed responses
• AES-GCM Encryption – Token security at rest
• Meta Instagram Graph API – Source of feed data
• Wrangler v4 – Deployment and secret management

Keeping tokens secure
Instagram access tokens are valuable and must never be exposed. Every token is encrypted with AES-GCM using a per-environment ENCRYPTION_KEY before storage in D1. The decryption happens only at request time, immediately before calling Instagram's API.

Avoiding Instagram rate limits
Frequent feed requests trigger Instagram's rate limiting. Implemented one-hour KV caching with intelligent invalidation. The X-Cache headers let us verify cache hits in development.

Managing OAuth complexity
The OAuth flow involves multiple steps: authorization, token exchange, long-lived token conversion, and encryption. Built a self-service portal that guides clients through each step with minimal friction.

• Eliminated third-party embed costs across 5+ client sites
• Sub-100ms global latency via Cloudflare edge deployment
• Zero manual token management through automated refresh
• Self-sustaining platform requiring no ongoing maintenance beyond occasional Meta app review renewals
• Consistent branding on client sites with a custom embeddable widget

instafeed.apalaugonzalez.com