Instagram (superadmin)
Experimental Instagram inbox for Patmos operators — not a merchant CRM feature
Last updated: 2026-09-01
Instagram inbox (experimental)
This is a Patmos superadmin experiment. It does not appear in Company settings, merchant CRM, or cashier POS.
Who can use it
Only users in the Sarah superadmin table. Shop admins and cashiers are redirected away from /superadmin/instagram and receive 403 on the inbox APIs. Those APIs prove the cookie JWT with the anon-key SSR client, then check the superadmin table — they do not treat the x-user header as the session.
Enablement is Connect Instagram (a connected_channels row). There is no env list of company ids and no hardcoded shop.
Meta app
Sarah uses the shared Tech Provider app Patmos Channels (META_APP_ID=1386194269924434). Connect is Facebook Login for Instagram against that Facebook app id, with Facebook Login for Business configuration Sarah Instagram (config_id=1063669696383947, env META_FACEBOOK_LOGIN_CONFIG_ID). The dialog requests instagram_basic, instagram_manage_messages, pages_show_list, pages_read_engagement, and pages_manage_metadata — no Instagram API onboarding extras, and not Instagram Login instagram_business_* scopes.
Do not use Landscape Facebook Login configs 1438441897747617 or 912538321416518.
Landscape-IG (1223099003236295) is Landscape's Instagram Login child. Do not use it for Sarah, and do not add sarah.ar redirect URIs there.
URLs on Patmos Channels Facebook Login (strict mode)
| Use | URL |
|---|---|
OAuth callback (prod NEXT_PUBLIC_URL) | |
| OAuth callback (apex, also allowlisted) | |
Do not change the Patmos Channels webhook callback URL to sarah.ar if it currently points at landscap.app — that would break Landscape. After Connect, Sarah lists DMs by polling Graph. The Sarah route /api/webhooks/meta still verifies HMAC if Meta posts to it.
Env
See instagram-inbox.env.example. Required at runtime: META_APP_SECRET, META_WEBHOOK_VERIFY_TOKEN, NEXT_PUBLIC_URL. META_FACEBOOK_LOGIN_CONFIG_ID defaults to the Sarah Instagram configuration (1063669696383947). META_IG_SEND_ENABLED defaults false (inbound DMs only).
Webhook HMAC (X-Hub-Signature-256) is fail-closed (403). Persist failures after a valid HMAC return 500. GET hub.challenge returns the challenge string.
Patmos tester account (not a code gate): @sarah.patmos, IG user id 17841470676628629, Business Portfolio 1058069757724279.
WhatsApp stays on Twilio (/api/whatsapp). This inbox does not replace it.