Security & OAuth Architecture

1. Password-Free OAuth 2.0 Authentication

InstaFlow never asks for, sees, or stores your Instagram, Facebook, or Google account passwords.

Account connection is handled exclusively through standard OAuth 2.0 PKCE authentication flows hosted directly on official Meta and Google consent screens. When you grant permissions, Meta and Google provide a scoped, revocable access token authorizing InstaFlow strictly to publish media containers and read basic publishing statuses.

2. Token Encryption & Isolated Storage

Access tokens granted to InstaFlow are encrypted both in transit (TLS 1.3) and at rest.

• Zero Plaintext Tokens: Sensitive credentials are never logged or exposed in client-side bundles.
• Cloudflare D1 & Distributed Isolation: Account records and queue tokens are stored within isolated Cloudflare D1 SQL databases protected by perimeter firewalls and strict authentication headers.
• Minimal Scopes: We request only the granular permissions required to publish reels and videos (e.g. instagram_content_publish and youtube.upload). We never request access to direct messages (DMs) or personal financial data.

3. Account Safety & Rate-Limit Safeguards

Many third-party tools trigger Instagram security flags by using unauthorized Android/iOS reverse-engineered API bots or sending too many requests too quickly.

InstaFlow strictly complies with Meta’s rate-limiting documentation. Every bulk queue item is spaced out by a user-defined safety interval (minimum 2–10 minutes depending on tier, with recommended settings of 1 post every 2–4 hours). If Instagram signals a rate limit, our cloud workers immediately pause the queue with exponential backoff to preserve your account standing.

4. Immediate Disconnection & Data Deletion

You maintain total ownership of your data at all times: