Scope Instagram access across its entire account lifecycle

Start from permitted purpose, not desired parity

A SaaS product should identify why Instagram access is needed, which user-owned account performs the workflow, what the provider officially permits, and what outcome remains useful if a method is unavailable. DewEngine has no released path. The project excludes scraping, provider-rule evasion, and anti-detection mechanisms. A route cannot establish full access; every resource and action requires separate approval, permission, implementation, and real-account evidence.

Align provider review with the customer workflow

Before an authorization screen exists, the application configuration, eligible account type, requested permissions, privacy disclosures, deletion route, redirect origins, and review materials should describe the same narrow use case. Development accounts or privileged roles can expose behavior ordinary customers will not have. Conformance must therefore use production-equivalent application settings and representative consented accounts before a method appears in onboarding or capability discovery.

Correlate the grant without trusting browser input

A short-lived auth intent binds workspace, application, environment, external user reference, allowed provider product, and redirect URI. State and provider identity are verified at callback before encrypted credential staging. The resulting connected account stores stable public and native identity references, not the raw token in customer code. Replay, cancellation, denied scope, wrong identity, and simultaneous reconnect need explicit outcomes that users can understand.

Return the methods this identity may use now

After connection, the account should expose authorized resources, reads, writes, events, missing scopes, eligibility blocks, health, sync progress, and evidence version. A healthy grant may still lack a publishing or messaging capability. Client libraries and product interfaces should consult that manifest rather than enable buttons from a generic Instagram label. Capability state can fall back after review expiry, policy change, or failed conformance.

Treat grant health as changing state

Refresh, provider revocation, linked-asset changes, account restrictions, application review changes, and customer role changes can alter what the integration may do. Workers recheck account and capability state immediately before provider contact. The console needs actionable reconnect or reauthorization guidance without revealing secrets. Metrics can track state transitions and lag through safe identifiers, while message, media, profile, and query content stay outside ordinary telemetry.

Disconnect must stop authority before data cleanup

A complete lifecycle fences new and leased commands, stops synchronization, attempts upstream revocation when supported, clears active grant material, records a non-sensitive receipt, and starts purpose-based deletion across normalized rows, objects, indexes, and backups. Customer export and legal exceptions need published rules. Release tests must prove reconnect cannot revive a deleted account or swap identity. Without that evidence, an access flow is incomplete regardless of how smoothly login works.

• Test grant loss and linked-asset removal during in-flight provider work
• Keep account deletion state distinct from upstream revocation and backup expiry