KO: Divi Insta Module for Graph API

Native Divi 5 module for displaying recent posts from a connected Instagram professional account through the Meta Graph API.

The feed uses an accessible horizontal carousel with previous and next controls, touch scrolling, keyboard navigation, and a configurable partial-card preview.

Full Cards Before Preview, Next Card Preview, and Show Navigation Arrows are native responsive Divi settings. They follow every enabled sitewide breakpoint, including Phone Wide, Tablet Wide, Widescreen, Ultra Wide, and customized breakpoint widths. Hiding the arrows does not disable touch scrolling or keyboard navigation.

The defaults show three complete cards at Widescreen and Ultra Wide, two cards plus a next-card preview from Tablet through Desktop, and one card plus a preview at Phone Wide and Phone.

The carousel watches both its module container and the browser viewport, so it recalculates card widths when Divi switches between custom breakpoint previews or when a responsive column grows without reloading the page.

Token lifecycle

Meta controls token lifetimes. The Settings screen includes a guided workflow with direct links to Meta Apps, Graph API Explorer, Access Token Debugger, and Meta's official long-lived token documentation.

The supported durable setup is:

1. Generate and extend a User token.
2. Use that long-lived User token to request the connected Page records.
3. Store the resulting Page access token, which Meta documents as having no scheduled expiration.

Optional Meta App ID and App Secret constants enable an administrator-only assisted exchange. An administrator supplies a current User token for one request, the plugin exchanges it server-side, finds and validates the connected Page token, and saves only that Page token. The submitted and intermediate User tokens are not saved to WordPress.

This is not silent auto-renewal. Meta requires interactive login after expired or revoked User authorization. Administrators can run a server-side token inspection from the Settings screen. The plugin records only normalized validity and expiration metadata, then evaluates those stored deadlines locally during the daily health check. A fresh Instagram media request remains the operational check for revocation and permission failures.

Security model

• The Meta access token is read only by PHP.
• wp-config.php constants override stored development settings.
• Optional App ID and App Secret values are accepted only from secure constants.
• Assisted exchange requires manage_options and a dedicated nonce.
• Submitted and intermediate User tokens are not saved to WordPress.
• Meta's documented exchange includes the App Secret and User token in the server-side request URL. Run the assisted exchange only on a trusted site while HTTP request debugging and logging are disabled.
• Meta's debug-token endpoint requires the inspected Page token in its server-side request URL. Keep HTTP request debugging and logging disabled during Check Token Expiration. The App access token is sent in the Authorization header, and the plugin does not store Meta's raw response.
• The published page is server-rendered.
• The Visual Builder preview uses an authenticated WordPress REST endpoint.
• The REST response contains normalized public media fields only.
• Feed responses are cached to limit Meta API requests.
• A daily server-side health check warns administrators if Meta rejects the token or a recorded token or data-access deadline approaches.

Configuration

Configure the Instagram Business Account ID and access token under Settings > KO: Divi Insta Module for Graph API. The account field requires Meta's numeric Instagram Business Account ID, not an @accountname or Instagram profile URL.

For production, the values can instead be defined in secure site configuration:

define( 'KO_DIVI_INSTA_GRAPH_USER_ID', 'the-instagram-business-account-id' );
define( 'KO_DIVI_INSTA_GRAPH_ACCESS_TOKEN', 'the-page-access-token' );

To enable the assisted server-side exchange while keeping the resulting Page token in the WordPress option, define:

define( 'KO_DIVI_INSTA_GRAPH_APP_ID', 'the-meta-app-id' );
define( 'KO_DIVI_INSTA_GRAPH_APP_SECRET', 'the-meta-app-secret' );

The App ID and App Secret do not replace User authorization. If Meta expires or revokes that authorization, an administrator must sign in through Meta again to obtain a current User token.

The plugin ships without an account ID or token. The settings screen can explicitly remove an option-stored fallback token, including while a secure configuration constant remains active.

Development

npm install
npm run build
npm run validate

The build synchronizes src/components/instagram-feed/module.json to modules-json/instagram-feed/module.json before compiling separate Visual Builder and published-page bundles.