title: Instagram API: do scopes work with OAuth2 implicit authentication flow?
body: <p>I'm making requests against the Instagram API from a mobile app. Currently, I'm just directing the user to the Instagram auth url and specifying the response type to be "access_token". Specifying this response_type is known as implicit auth.</p>
  
  <p>Explicit auth: response_type=code
  Implicit auth: response_type=access_token</p>
  
  <p>I'm trying to get around needing to stand up a web service to facilitate explicit auth. This would be necessary because in explicit auth flow, the Instagram API needs to make a call to a redirect URL and pass in a "code" parameter. The code would then be used by my server-side code to make a final request to Instagram for an access token.</p>
  
  <p>It's much more efficient for a mobile app to use implicit flow because no extra privately-maintained auth service needs to be stood up to handle it.</p>
  
  <p>Instagram supports the following scopes:</p>
  
  <ul>
  <li>basic - to read any and all data related to a user (e.g.
  following/followed-by lists, photos, etc.) (granted by default)</li>
  <li>comments - to create or delete comments on a user’s behalf</li>
  <li>relationships - to follow and unfollow users on a user’s behalf</li>
  <li>likes - to like and unlike items on a user’s behalf</li>
  </ul>
  
  <p>When I make any other type of scope specification besides "basic", I get the following response when the user provides the credentials at the auth URL:</p>
  
  <pre><code>{"code": 400, "error_type": "OAuthException", "error_message": "Invalid scope field(s): basic+likes"}
  </code></pre>
  
  <p>Any combination of scopes other than "basic" gives the same response.</p>
  
  <p>So, my question are these: </p>
  
  <ul>
  <li><strong>Is explicit auth required in order to specify scopes beyond "basic"??</strong> </li>
  <li><strong>Do I need to specify response_type=code in order for extended scopes to work?</strong></li>
  <li><strong>Is this an Instagram limitation, or is it a limitation of OAuth 2.0?</strong></li>
  </ul>
  
  <p>Thanks in advance.</p>