---
title: "Instagram (superadmin)"
description: "Experimental Instagram inbox for Patmos operators — not a merchant CRM feature"
keywords: ["instagram", "superadmin", "inbox", "meta"]
lastUpdated: "2026-09-01"
---

# Instagram inbox (experimental)

This is a **Patmos superadmin** experiment. It does **not** appear in Company settings, merchant CRM, or cashier POS.

## Who can use it

Only users in the Sarah `superadmin` table. Shop admins and cashiers are redirected away from `/superadmin/instagram` and receive 403 on the inbox APIs. Those APIs prove the cookie JWT with the anon-key SSR client, then check the superadmin table — they do not treat the `x-user` header as the session.

Enablement is **Connect Instagram** (a `connected_channels` row). There is no env list of company ids and no hardcoded shop.

## Meta app

Sarah uses the shared Tech Provider app **Patmos Channels** (`META_APP_ID=1386194269924434`). Connect is Facebook Login for Instagram against that Facebook app id, with Facebook Login for Business configuration **Sarah Instagram** (`config_id=1063669696383947`, env `META_FACEBOOK_LOGIN_CONFIG_ID`). The dialog requests `instagram_basic`, `instagram_manage_messages`, `pages_show_list`, `pages_read_engagement`, and `pages_manage_metadata` — no Instagram API onboarding extras, and not Instagram Login `instagram_business_*` scopes.

Do **not** use Landscape Facebook Login configs `1438441897747617` or `912538321416518`.

**Landscape-IG** (`1223099003236295`) is Landscape's Instagram Login child. Do not use it for Sarah, and do not add sarah.ar redirect URIs there.

## URLs on Patmos Channels Facebook Login (strict mode)

| Use | URL |
|-----|-----|
| OAuth callback (prod `NEXT_PUBLIC_URL`) | `https://www.sarah.ar/api/integrations/meta/instagram/callback` |
| OAuth callback (apex, also allowlisted) | `https://sarah.ar/api/integrations/meta/instagram/callback` |

Do **not** change the Patmos Channels webhook callback URL to sarah.ar if it currently points at landscap.app — that would break Landscape. After Connect, Sarah lists DMs by polling Graph. The Sarah route `/api/webhooks/meta` still verifies HMAC if Meta posts to it.

## Env

See `instagram-inbox.env.example`. Required at runtime: `META_APP_SECRET`, `META_WEBHOOK_VERIFY_TOKEN`, `NEXT_PUBLIC_URL`. `META_FACEBOOK_LOGIN_CONFIG_ID` defaults to the Sarah Instagram configuration (`1063669696383947`). `META_IG_SEND_ENABLED` defaults **false** (inbound DMs only).

Webhook HMAC (`X-Hub-Signature-256`) is fail-closed (403). Persist failures after a valid HMAC return 500. GET `hub.challenge` returns the challenge string.

Patmos tester account (not a code gate): `@sarah.patmos`, IG user id `17841470676628629`, Business Portfolio `1058069757724279`.

WhatsApp stays on Twilio (`/api/whatsapp`). This inbox does not replace it.