I've been trying to use Instagram's API to extract tagged photos to show on a website, but have had trouble generating an access token (not part of this question).
So I just found a random website using one of these scripts and borrowed their access token (just for testing).
So my questions are, what is the point of going to the trouble of generating an access token if it just gets made public anyway? Could someone do something malicious with my access token? Will it affect rate limits? Basically, should they be kept private?