How is challenge/response supposed to work?

Hi! I’m trying to wrap my head around the challenge but can’t seem to figure it out.

When trying to login, I’m getting

StatusCodeError: 400 - {"message":"checkpoint_required","checkpoint_url":"/challenge/ABCABC/123123/","lock":false,"status":"fail"}

which means that a challenge needs a response.

I’ve tried browsing to instagram.com/challenge/ABCABC/123123 (in my normal web browser) and completing the challenge, but on the next attempt to login programmatically, I’m getting a new challenge, and so it continues.

I’ve also tried

1. logging in (and getting the challenge error)
2. requesting getChallenge, which responds with

{ challengeType: 'SelectVerificationMethodForm',
  errors: [],
  experiments: {},
  extraData:
   { __typename: 'GraphChallengePage',
     content: [ [Object], [Object], [Object], [Object] ] },
  fields:
   { choice: '1',
     fb_access_token: 'None',
     big_blue_token: 'None',
     google_oauth_token: 'None',
     email: '*********@gmail.com',
     phone_number: '+** ** *** ** **' },
  navigation:
   { forward: '/challenge/ABCABC/123123/',
     replay: '/challenge/replay/ABCABC/123123/',
     dismiss: 'https://www.instagram.com/' },
  privacyPolicyUrl: '/about/legal/privacy/',
  type: 'CHALLENGE' }

1. Updating the challenge

client.updateChallenge({ challengeUrl: "/challenge/ABCABC/123123/", choice: 1 })

But that updateChallenge is returning HTML content(!), which says

This page could not be loaded. If you have cookies disabled in your browser, or you are browsing in Private Mode, please try enabling cookies or turning off Private Mode, and then retrying your action

So how is the challenge-response flow supposed to work?

[mkgerasimenko]

@gutosanches, I may have solved that problem with:

await client.updateChallenge({challengeUrl, choice: 1});
await client.updateChallenge({ challengeUrl, securityCode: 'VERIFICATION_CODE_FROM_EMAIL'});

In my case I need to update Challenge with security code from Instagram email.

Full code (TS):

public async login(): Promise<Instagram> {
        const client = new Instagram({username: this.username, password: this.password});
        try {
            await client.login();
        } catch (err) {
            if (err.error && err.error.message === 'checkpoint_required') {
                const challengeUrl = err.error.checkpoint_url;

                await client.updateChallenge({challengeUrl, choice: 1});
                await client.updateChallenge({ challengeUrl, securityCode: '301794'}); // <== securityCode - set code from email.
            }
        }
        return await client;
    }

Notes:

1. I use Gmail email for Instagram.
2. I use imap-simple for getting the Security code from Instagram Email.

[samholmes]

I spent a lot of time with these challenges in order to figure out the appropriate way to use the API. First, you’ll need to save the challengeUrl returned from the login form. I then use getChallenge to get the challenge JSON object. From there you can read the challengeType which will determine what do to. Here’s the challengeTypes that I found:

1. SelectVerificationMethodForm This is the form you see asking you whether to send the verification via email or mobile text. Use updateChallenge to set the choice, and after invocation, the verification email/text will be sent.
2. VerifyEmailCodeForm This is the form you see when asking for the verification code from email. This doesn’t require a choice when calling updateChallenge (in fact, I believe it will give an error). Instead, send the securityCode with the updateChallenge invocation. If no security code was sent, you can use replayChallenge to have the security code sent again.

There may be other challengeTypes worth documenting, but these are enough to get a working challenge passing algorithm started. I would log any other challenge types that aren’t handled by your app, and share them with some context so we can all figure out what they mean and document them.

Cheers!