Q: From a security point of view is it ok to send an instagram user access token and userid to a client in a JSON object? Is it a problem that I store instagram userid and token in my database and then send it in a json object to members of the public. The instagram user who uploaded their credentials of course knows that this is occuring, and can disconnect their instagram profiles at any time.
Is this a problem?
I am using instafeed for this
  initStagram(id, token){
    var feed = new Instafeed({
      get: 'user',
      userId: id,
      accessToken: token,
      resolution:"standard_resolution",
      template: '<a target="_blank" href="{{link}}"><img class="isstyle img-rounded" src="{{image}}" alt="{{caption}}"/></a>'
    });
    feed.run();
  }


A: Instead of sending JSON object with access_token, you can just use the access_token received in hash fragment after user completes Instagram login, and save it in app. This way access_token is only received by client only after actual user logs in. 
I'm guessing you have your own API to get JSON object with access_token, then anyone will be able to make that call and get anyone's access_token?
The secure way to do it is to have instagram send the access_token to client using the redirect_uri. Also when the user logs out in app, you should delete the saved access_token
