# Instagram App Access Token

Instagram Bloks bundle embedded a first-party app access token in a Base64 action string, leaking admin-level Graph API credentials via the photo upload request.

- Payout: $38,250
- Severity: high
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2022-02-24
- Write-up quality: 8/10
- Original: https://philippeharewood.com/instagram-app-access-token/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-instagram-app-access-token
- Tags: domain:mobile domain:web3 impact:internal-access kind:bounty platform:blog sev:high tech:graphql technique:js-analysis technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Instagram Bloks app bundle / rupload.facebook.com media upload
**Root cause:** Bloks bundle for the ratings-and-reviews composer embedded a first-party Instagram application access token (appID|secret) inside a Base64-encoded action string used by ig.action.media.UploadMediaV3, exposing it in the client-side bundle and upload Authorization header.
**Steps:**
1. Open Instagram ratings/reviews composer Blok (app_id com.bloks.www.bk.commerce.ratings_and_reviews.all_reviews) and capture the bundle tree
2. Base64-decode embedded action strings; locate `catalog_item_uploads124024574287414|Jor32q7Rh50x2LZL1Aw2F4f8bjw` near `ig.action.media.UploadMediaV3`
3. Observe token pattern `[0-9]+|[a-z0-9]+` is longer than a client token, indicating an application access token
4. Send `GET graph.facebook.com/app/roles` with `Authorization: Bearer 124024574287414|Jor32q7Rh50x2LZL1Aw2F4f8bjw` to enumerate admins non-destructively
5. Fuzz similar Bloks via GraphQL to find additional embedded tokens
**How found:** Noticed the Authorization header on the rupload request used a token longer than the client-token pattern `[0-9]|[a-z0-9]*`, then decoded Base64 action strings in the Bloks bundle to trace where it originated.
**Exploitation:** Attacker extracts the app access token from the client bundle and uses it against Graph API app-admin endpoints (e.g. /app/roles) to enumerate ~25 admin/developer user IDs; Meta states protections prevented further impact.
**Escalation:** Used a GraphQL bug at the time to fuzz sibling Bloks and found an additional application token, demonstrating the pattern was not isolated.
**Insight:** In Bloks/mobile bundles, Base64-decode every embedded action string and grep for `appID|secret` patterns; distinguish app tokens from client tokens by length/charset of the secret segment, then test non-destructively against /app/roles.