When we first built GrabReels, we assumed it would be a weekend project. We were wrong. Instagram's content delivery infrastructure is deliberately complex, and building something reliable on top of it required solving several non-obvious engineering problems. This post is a candid look at how GrabReels works — and why it works the way it does.
The Core Challenge: Instagram's CDN URL Rotation
Instagram doesn't serve media from permanent URLs. Every video and image is hosted on Facebook's CDN (cdninstagram.com and fbcdn.net) with signed, time-limited URLs. These URLs expire within a few hours — meaning a download link generated at 2pm may be invalid by 6pm.
This is intentional. Instagram rotates CDN signatures to prevent hotlinking (embedding their media directly on external sites) and to limit the effectiveness of download tools.
Our solution: GrabReels fetches fresh CDN URLs at the moment of each download request, rather than caching them. Every time you paste a link and click Download, we're fetching a new, valid CDN URL in real time. This adds a small amount of latency but ensures the download never fails due to an expired link.
The Proxy Download Architecture
You might wonder: why doesn't GrabReels just give you the CDN URL directly and let your browser download from it?
The answer is CORS (Cross-Origin Resource Sharing). Instagram's CDN servers return Access-Control-Allow-Origin: * for some resources but not others, and this changes without notice. A direct browser download from fbcdn.net often fails with a CORS error or triggers an authentication redirect.
Instead, GrabReels proxies the download: our server fetches the file from Instagram's CDN and streams it to your browser. Your browser receives the file directly from us, not from Instagram's CDN. This is why downloads are reliable — we handle all the Instagram-side complexity server-to-server, then deliver you a clean file.
This architecture also means we can set a proper Content-Disposition: attachment header, which triggers the "Save file" dialog in your browser rather than opening the video inline.
Parsing Instagram Posts: The Extraction Layer
To download media, we first need to extract the media URLs from an Instagram post. Instagram doesn't offer a public API for this (their Graph API is restricted to business accounts and requires user authentication). Instead, we parse Instagram's webpage response.
When you load any public Instagram post URL, the page contains a large JSON payload embedded in a <script> tag. This payload includes media URLs, dimensions, video duration, captions, and more. We parse this JSON structure to extract what we need.
The challenge: Instagram changes this JSON structure periodically, sometimes breaking extractors without warning. We maintain automated monitoring that alerts us within minutes if the extraction layer breaks, so we can deploy a fix quickly.
Carousel Posts: The N+1 Problem
Instagram carousel posts contain up to 10 slides (images or videos). Each slide has its own media URL, and all 10 may be served from different CDN nodes.
Our carousel extraction makes a single request to the post URL and parses all slide URLs from the embedded JSON in one pass. We return all URLs simultaneously, which is why GrabReels can show a preview of all carousel slides instantly — without making 10 separate requests.
The "Download All" feature then downloads each file sequentially with a small delay to avoid overwhelming either Instagram's CDN or your browser's download queue. Chrome and Safari both handle simultaneous downloads differently; sequential downloads with delays produce the most reliable results across all browsers.
Rate Limiting: The Abuse Prevention Layer
A tool that can download any public Instagram content is a target for abuse: bulk scrapers, automated tools that download thousands of posts, and bots that try to use GrabReels as an Instagram scraping proxy.
We implement rate limiting using Upstash Redis — a serverless Redis service that works at the edge with near-zero latency. Each IP address is limited to a maximum number of requests per time window. Requests above the limit receive a 429 response.
This protects the service for legitimate users while making automated abuse impractical. The rate limits are set conservatively — any normal human usage pattern falls well within them.
The Domain Whitelist
Our proxy download endpoint only accepts requests to proxy URLs from known Instagram CDN domains: instagram.com, cdninstagram.com, and fbcdn.net. Any attempt to use our proxy to fetch arbitrary URLs is blocked.
This is a critical security control — without it, a bad actor could use GrabReels as an open proxy to make requests to any URL on the internet from our server's IP address.
What We Can't Download (And Why)
- Private account content: We only parse publicly accessible URLs. Private accounts require authentication — which we deliberately don't support, both for privacy reasons and because Instagram's authentication tokens are user-specific.
- Instagram Stories (active): Stories use a different CDN path that requires authentication. After 24 hours, Stories are deleted from Instagram's servers entirely — there's nothing to download.
- Instagram Live: Live video is a real-time stream. There is no static file to download. Instagram converts some Lives to Reels after the fact, which can then be downloaded normally.
Our Tech Stack
GrabReels is built on Next.js 14 (App Router) with server-side API routes handling the extraction and proxying. The frontend is React 18 with TypeScript and Tailwind CSS. We deploy on Vercel's edge network, which gives us global low-latency access to users worldwide. Upstash Redis handles rate limiting.
Conclusion
Building GrabReels required solving CDN URL rotation, CORS proxy architecture, Instagram page parsing, carousel extraction, and rate limiting — none of which is documented or straightforward. The result is a tool that works reliably because it handles all of Instagram's complexity behind the scenes, giving you a one-click download experience.
