Index: classes/tggr-media-source.php
===================================================================
--- classes/tggr-media-source.php	(revision 1708251)
+++ classes/tggr-media-source.php	(working copy)
@@ -267,7 +267,7 @@
 			$class = get_called_class();
 			$setting = str_replace( $class::SETTINGS_PREFIX, '', $field['label_for'] );
 			$textarea_settings = array( 'highlighted_accounts', 'banned_accounts' );
-
+			$checkbox_settings = array( 'sandbox_mode' );
 			require( dirname( __DIR__ ) . '/views/media-sources-common/page-settings-fields.php' );
 		}
 
Index: classes/tggr-source-instagram.php
===================================================================
--- classes/tggr-source-instagram.php	(revision 1708251)
+++ classes/tggr-source-instagram.php	(working copy)
@@ -1,7 +1,5 @@
 <?php
 
-// todo Instagram requires oAuth now, so this is broken == https://wordpress.org/support/topic/instagram-issuses/#post-8425118
-
 if ( $_SERVER['SCRIPT_FILENAME'] == __FILE__ )
 	die( 'Access denied.' );
 
@@ -29,11 +27,13 @@
 		 */
 		protected function __construct() {
 			$this->view_folder   = dirname( __DIR__ ) . '/views/'. str_replace( '.php', '', basename( __FILE__ ) );
-			$this->setting_names = array( 'Client ID', 'Highlighted Accounts', 'Banned Accounts', '_newest_media_id' );
+			$this->setting_names = array( 'Client ID', 'Client Secret', 'Redirect URL', 'Access Token', 'Sandbox Mode', 'Highlighted Accounts', 'Banned Accounts', '_newest_media_id' );
 
 			foreach ( $this->setting_names as $key ) {
 				$this->default_settings[ strtolower( str_replace( ' ', '_', $key ) ) ] = '';
 			}
+
+			$this->default_settings[ 'sandbox_mode' ] = 1;
 			$this->default_settings[ '_newest_media_id' ] = 0;
 
 			$this->register_hook_callbacks();
@@ -136,10 +136,16 @@
 		 * @param string $hashtag
 		 */
 		public function import_new_items( $hashtag ) {
+			if ( empty( TGGRSettings::get_instance()->settings[ __CLASS__ ]['client_id'] )
+				|| empty( TGGRSettings::get_instance()->settings[ __CLASS__ ]['access_token'] ) ){
+				return;
+			}
 			$media = self::get_new_media(
 				TGGRSettings::get_instance()->settings[ __CLASS__ ]['client_id'],
+				TGGRSettings::get_instance()->settings[ __CLASS__ ]['access_token'],
 				$hashtag,
-				TGGRSettings::get_instance()->settings[ __CLASS__ ]['_newest_media_id']
+				TGGRSettings::get_instance()->settings[ __CLASS__ ]['_newest_media_id'],
+				TGGRSettings::get_instance()->settings[ __CLASS__ ]['sandbox_mode']
 			);
 			$media = $this->remove_banned_items( $media, 'user', 'username' );
 
@@ -152,21 +158,34 @@
 		 * @mvc Model
 		 *
 		 * @param string $client_id
+		 * @param string $access_token
 		 * @param string $hashtag
+		 * @param string $sandbox_mode
 		 * @param string $max_id The ID of the most recent item that is already saved in the database
 		 * @return mixed string|false
 		 */
-		protected static function get_new_media( $client_id, $hashtag, $max_id ) {
+		protected static function get_new_media( $client_id, $access_token, $hashtag, $max_id, $sandbox_mode ) {
 			$response = $media = false;
 
-			if ( $client_id && $hashtag ) {
-				$url = sprintf(
-					'%s/v1/tags/%s/media/recent?client_id=%s',
-					self::API_URL,
-					urlencode( str_replace( '#', '', $hashtag ) ),
-					urlencode( $client_id )
-				);
+			if ( $access_token && $hashtag ) {
 
+				if ( $sandbox_mode === '0' ){
+					// url for PUBLIC tags // https://api.instagram.com/v1/tags/XXXX/media/recent/?access_token=XXXX
+					$url = sprintf(
+						'%s/v1/tags/%s/media/recent?access_token=%s&count=9',
+						self::API_URL,
+						urlencode( str_replace( '#', '', $hashtag ) ),
+						urlencode( $access_token )
+					);
+				} else {
+					// url for SELF posts https://api.instagram.com/v1/users/self/media/recent/?access_token=XXXX
+					$url = sprintf(
+						'%s/v1/users/self/media/recent?access_token=%s&count=9',
+						self::API_URL,
+						urlencode( $access_token )
+					);
+				}
+
 				$response = wp_remote_get( $url );
 				$body     = json_decode( wp_remote_retrieve_body( $response ) );
 
@@ -175,7 +194,7 @@
 				}
 			}
 
-			self::log( __METHOD__, 'Results', compact( 'client_id', 'hashtag', 'max_id', 'response' ) );
+//			self::log( __METHOD__, 'Results', compact( 'access_token', 'hashtag', 'max_id', 'response' ) );
 
 			return $media;
 		}
Index: views/media-sources-common/page-settings-fields.php
===================================================================
--- views/media-sources-common/page-settings-fields.php	(revision 1708251)
+++ views/media-sources-common/page-settings-fields.php	(working copy)
@@ -8,6 +8,17 @@
 		echo esc_textarea( TGGRSettings::get_instance()->settings[ $class ][ $setting ] );
 	?></textarea>
 
+<?php elseif ( in_array( $setting, $checkbox_settings, true ) ) : ?>
+	<input type="hidden" name="<?php echo esc_attr( Tagregator::PREFIX ); ?>settings[<?php echo esc_attr( $class ); ?>][<?php echo esc_attr( $setting ); ?>] ); ?>" value="0" />
+	<input
+			type="checkbox"
+			id="<?php echo esc_attr( $class::SETTINGS_PREFIX . $setting ); ?>"
+			name="<?php echo esc_attr( Tagregator::PREFIX ); ?>settings[<?php echo esc_attr( $class ); ?>][<?php echo esc_attr( $setting ); ?>] ); ?>"
+			class="regular-text"
+		<?php checked( '1',  esc_attr( TGGRSettings::get_instance()->settings[ $class ][ $setting ] )); ?>
+			value="1"/>
+	<?php _e( 'Enabled' ); ?>
+
 <?php else: ?>
 
 	<input
Index: views/tggr-source-instagram/page-settings-section-header.php
===================================================================
--- views/tggr-source-instagram/page-settings-section-header.php	(revision 1708251)
+++ views/tggr-source-instagram/page-settings-section-header.php	(working copy)
@@ -1 +1,69 @@
-<p>You can obtain the Client ID by logging into <a href="https://www.instagram.com/developer/">Instagram's developer portal</a>, and then registering a new client.</p>
+<p>Instructions:</p>
+<p>1. You can obtain the Client ID &amp; Client Secret by logging into <a href="https://www.instagram.com/developer/">Instagram's developer portal</a>, and then registering a new client. Insert them to the fields bellow and click <strong>'Save Changes'</strong>.</p>
+<p></p>
+<p>2. Copy the Redirect URL from the field below and paste it in your <strong>Valid redirect URIs</strong> field in your Instagram API Client Settings.</p>
+<p></p>
+<p>3. <a href="" id="get_access_token">Click here to get your Access Token!</a> - After the Access Token is in the field please click <strong>'Save Changes'</strong>.</p>
+<p></p>
+<p><strong>Note:</strong> Sandbox mode will retrieve your account's 9 latest posts ignoring the #hashtag. Non-sandbox will retrieve the latest hashtags posts from all instagram as long as there is permission for 'public_content' in your client.</p>
+<?php
+
+$tggroptions = get_option( 'tggr_settings', array() );
+
+$cid = $tggroptions['TGGRSourceInstagram']['client_id'];
+$cse = $tggroptions['TGGRSourceInstagram']['client_secret'];
+$cre = $tggroptions['TGGRSourceInstagram']['redirect_url'];
+$fat = $tggroptions['TGGRSourceInstagram']['access_token'];
+
+if ( ! empty( $_GET['code'] ) ) {
+	$icode = sanitize_text_field( $_GET['code'] );
+} else {
+	$icode = '';
+}
+
+if ( $icode !== '' && $fat === '' ) {
+
+	$url = 'https://api.instagram.com/oauth/access_token';
+
+	$response = wp_remote_post( $url, array(
+			'method' => 'POST',
+			'timeout' => 45,
+			'body' => array(
+				'client_id' => $cid,
+				'client_secret' => $cse,
+				'grant_type' => 'authorization_code',
+				'redirect_uri' => $cre,
+				'code' => $icode,
+			),
+		)
+	);
+	if ( is_wp_error( $response ) ) {
+		$error_message = $response->get_error_message();
+		echo "Something went wrong: $error_message";
+	} else {
+		$decode_response = json_decode($response['body'], true);
+
+		$at = $decode_response['access_token'];
+	}
+
+	if ( $at !== '' ) {
+		?>
+		<script>
+			(function( $ ) {
+				$( document ).ready( function() {
+					$( '#tggr_instagram_access_token' ).val( '<?php echo $at; ?>' );
+				});
+			})( jQuery );
+		</script>
+		<?php
+	}
+}
+?>
+<script>
+	(function( $ ) {
+		$( document ).ready( function() {
+			$( '#tggr_instagram_redirect_url' ).val(window.location.href);
+			$( '#get_access_token' ).attr('href', 'https://www.instagram.com/oauth/authorize/?client_id=' + $('#tggr_instagram_client_id').val() + '&redirect_uri=' + $( '#tggr_instagram_redirect_url' ).val() + '&response_type=code');
+		});
+	})( jQuery );
+</script>
\ No newline at end of file