Instagram Omniauth on Rails invalid_credentials

Question

I've had an instagram omniauth integration working now for a few years and I haven't changed anything in a long time but my customers are occasionally out of the blue getting an error when connecting their Instagram accounts:

Started GET "/auth/instagram/callback?code=d3b1c4d88e2f440b8a8a98037b821c15&state=2565d32ecd3cc5967f32d8c945db6ffba74dc784100777f2" for 127.0.0.1 at 2016-12-15 15:29:59 -
0800
I, [2016-12-15T15:29:59.276712 #32520]  INFO -- omniauth: (instagram) Callback phase initiated.
E, [2016-12-15T15:29:59.519801 #32520] ERROR -- omniauth: (instagram) Authentication failure! invalid_credentials: OAuth2::Error, :
{"code": 400, "error_type": "OAuthException", "error_message": "Matching code was not found or was already used."}

The only way I can consistently get this to happen is to connect the account from my app, then remove permissions from the instagram end, then try to reconnect again on my app, but it seems like some of my customers are getting this the first time they connect their instagram accounts.

Anyone encountered this before? My config/initializers/omniauth.rb looks like this:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :instagram, ENV['INSTAGRAM_CLIENT_ID'], ENV['INSTAGRAM_CLIENT_SECRET'], scope: 'basic comments public_content'
end

Edit:

I'm using omniauth 1.3.1 and omniauth-instagram 1.0.2

My routes is just your basic omniauth route:

 get '/auth/:provider/callback', to: 'omniauth_callbacks#create'

And my controller action is a bit complex but it looks like this:

class OmniauthCallbacksController < ApplicationController

  def create
    if user_signed_in?
      social_account = SocialAccount.from_omniauth(auth_params, current_user)
      social_account.save!
      redirect_to root_path
    else
      user = User.from_omniauth auth_params
      sign_in_and_redirect user
    end
  end

  private

  def auth
    request.env['omniauth.auth']
  end

  def auth_params
    {
      provider: auth['provider'],
      uid: auth['uid'],
      token: auth['credentials']['token'],
      secret: auth['credentials']['secret'] || auth['credentials']['refresh_token'],
      name: auth['info']['nickname'] || auth['info']['name'],
      emails_sent: 0
    }
  end
end

Basically it creates a new user and signs them in if they haven't connected, and it updates their login info if they have.

Answer 1

There seems to be a problem on Instagram around getting access tokens. https://news.ycombinator.com/item?id=13178789