Instagram returning “Matching code was not found or was already used” when using OAuth

Question

I am trying to use the Instagram OAuth using the developer documentation at

https://www.instagram.com/developer/authentication/.

Step 1 and 2 are working without any problems, so I have my Client-ID, the Client-Secret, the Redirect-URI and the code.

But every-time I am trying to get the Acces Token I get the following error:

{
"code": 400, 
"error_type": "OAuthException", 
"error_message": "Matching code was not found or was already used."
}

Any tips how to solve this?

Answer 1

We are experiencing the same issue. It appears that logging out of Instagram, then attempting to use Instagram OAuth through our site after we are logged out of Instagram is a workaround.

Answer 2

We're experiencing the same issue since yesterday (after months of working fine) - have reported it as an issue yesterday via the 'Report Issue' function on https://www.instagram.com/developer/clients/manage/ and I'd encourage you to do the same.

Yet to hear back, but seems likely it's their end having issues rather than something we're doing.

EDIT: It's also working fine for us on our development servers (which use different IPs for interacting with IG's API) but not working on our production server from any of the IPs we have available on the production server.

EDIT2: (July 2016) Just tested and it's mysteriously started working again on our production servers. No reply to the support ticket from Instagram as yet.

EDIT3: (December 2016) And now it's failing again with the same message... Seems like it's Instagram's end again. Nothing much we can do. Frustrating.

Answer 3

Logging in to Instagram, then complete Step 1 from the API Docs (https://api.instagram.com/oauth/authorize/?client_id=CLIENT-ID&redirect_uri=REDIRECT-URI&response_type=code), then follow the redirect and copying the code from the URL, then logging out of my account, then completing Step 3:

curl -F 'client_id=CLIENT_ID' \
-F 'client_secret=CLIENT_SECRET' \
-F 'grant_type=authorization_code' \
-F 'redirect_uri=AUTHORIZATION_REDIRECT_URI' \
-F 'code=CODE' \
https://api.instagram.com/oauth/access_token

That worked for me.

Answer 4

We are also experiencing the same issue from yesterday, looks like clearing browser (or new incognito window) do the trick. Although, the mobile app where we are authenticating through mobile browser, working fine.

Answer 5

Update: Deleted all my browsing history, cleared cache, etc. Like it was a brand new browser and now it works with no issue.

I've been hammering on the auth URL for weeks now. Testing and using the same stored token to re-authorize. Maybe stored tokens have a limit to the number of times they can be re-used?

======

Having the same issue as of today. Authorization was working fine earlier - now I'm getting the same 'Matching code...' response.

Signed in and out of my Instagram account repeatedly, created a new app id and disabled/enabled Implicit Oauth - all with no success.

The 'Authorized Applications' view in my Instagram account reports that my application has indeed been authorized, but I can't make calls to the API. Authenticating through an Incognito window returned a successful response but it's not a solution.

Tried reporting to Instagram through their 'Report Issue' form, but it won't allow me to submit the form.

Answer 6

SOLVED! Just log out of Instagram and try again. That worked for me.

Answer 7

I solved this by creating a service on the backend/server side that authorised the user.

My backend API is a ruby on rails app. Here is a code snippet to understand.

  def token
    @response = Instagram.get_access_token(params[:code], redirect_uri: mobile_token_url)
    instagram_user = InstagramUserCreator.new(user_params)
    if instagram_user.find_or_create
      redirect_to "taddarmobileapp://?token=#{instagram_user.user.token}"
    else
      redirect_to 'taddarmobileapp://'
    end
  end

I just store the token on the phone and use it to authorise the user to my backend API.