Instagram API Matching code was not found or was already used

I am seeing this error from my live server using the Instagram API.

{
   "Error":true,
   "message":"Matching code was not found or was already used."
}

I have read a few suggestion on here to clear cache but that isn't fixing the issue. I am also unable to submit a support ticket directly on the Instagram site as I am receiving an error message while attempting to submit a ticket.

There are a bunch of developers complaining about the same issue at https://news.ycombinator.com/item?id=13178789. I don't think unchecking "Disable implicit OAuth" fixes the issue as I have already tried that and it didn't work.

The best thing you can do is to submit a report to instagram using your client id to put some pressure on their side to fix this issue.

I have the same issue, I guess it's from Instagram I reported an issue from my client panel in developer > manage clients > Report issue. You can do they resolve this issue as soon as possible.

There is definitely a problem with the Instagram OAuth flow. The returned authorization code doesn't seem to work for some reason, it's very likely a network related problem that they need to fix on their end.

My theory is that the authorization code generated is not distributed to all Instagram API servers, and if you happen to hit a bad node then you're out of luck.

However, I recently found a solution that doesn't rely on the authorization code. If you use the client-side authentication then you'll be able to retrieve the access token without ever using the authorization code. It's less secure but works great as a temporary fix.

You simply change response_type=code to response_type=token. The token response type will redirect the user back to your website using this URL structure:

http://your-redirect-uri#access_token=ACCESS-TOKEN

I recommend fetching the access token from the URL client-side using JavaScript, and then passing it to an endpoint on your website. E.g. /callback?accesstoken={accessToken}. This is required because the content in the hash is not passed to the server.

Example:

<script>
    if (window.location.hash && window.location.hash.indexOf('#access_token=') !== -1) {
        var accessToken = window.location.hash.replace('#access_token=', '');
        window.location.href = '/callback?accesstoken=' + accessToken;
    }
</script>

The code snippet above is copied and slightly modified from the solution at https://news.ycombinator.com/item?id=13178789

You can read more about Instagram client side authentication on https://www.instagram.com/developer/authentication/ under Client-Side (Implicit) Authentication

This is due to security restrictions in place on your Instagram app. You can choose to allow it by unchecking "Disable implicit OAuth" for your Instagram app, under the Security tab.

来源：https://stackoverflow.com/questions/41210164/instagram-api-matching-code-was-not-found-or-was-already-used

标签

instagram-api