Platform and API terms of use

This page is about software that talks to nicagram — apps, bots, bridges, research tools — rather than about people using the website. The binding agreement is this server's terms of use and its privacy policy; what follows is what those mean if you are holding an access token.

Identify yourself

• Register your application and use its own credentials. Do not ship somebody else's client id, and do not impersonate another client.
• Keep your client secret secret. An application that leaks one has handed out the ability to act in its name.

A token belongs to the person who granted it

• Request the narrowest scopes your feature needs, and request them when the person can see what they are agreeing to.
• Do not share, sell or transfer tokens, and do not use one for anything the person who granted it would not recognise as the thing they asked for.
• When somebody disconnects your application, stop using what you collected through it.

Respect visibility

A post that is unlisted, followers-only or direct is not public data because a token can read it. Do not republish it, index it, or expose it to an audience the author did not choose. This is the rule that gets broken most often and it is the one that does the most damage.

• Honour deletions. When a post or an account disappears, remove your copy of it.
• Honour blocks and mutes. Do not use an API to route around a block a person set.

Bulk collection

Do not use the API to assemble a database of people, to scrape media at scale, or to collect content for resale or for training a model, without the informed consent of the people involved. The fact that a request succeeds is not permission.

Be a good client

• Respect rate limits. Back off when you are told to rather than retrying immediately — a client that hammers a 429 is indistinguishable from an attack.
• Cache what does not change. Poll no faster than your feature needs.
• Do not automate follows, likes or messages at a scale a person could not perform, and do not send unsolicited messages.

Enforcement

The operators of nicagram can revoke an application's credentials, or any individual token, at any time and without notice. That is the only enforcement mechanism the software has, so it is used bluntly.

The operators of nicagram can be reached from the contact page.

The technical detail — endpoints, the OAuth flow, rate limit behaviour — is on the developer API page.