I've been using oembed, particularly for Instagram (still figuring out how to get Twitter to work), for our Lightning Component to show some Instagram post(s). I've been using the https://platform.instagram.com/en_US/embeds.js file and uploaded this as a static resource to load in my Lightning Component.

The Lightning Security Docs mentions below:

When submitting a Lightning component or app for security review, include all source JavaScript files in static resources, as we cannot review minified code directly. Failure to do so will delay the review of your components until we get the appropriate source files.

I don't think there is a way to procure the unminified version of the file. I'm wondering if anyone has a workaround for this?

1 Answer 1


Yes, you do need to provide the original sources, so I would reach out to Instagram. This is also something that you should do in the planning stages -- e.g. before you decide whether to go ahead and make this integration. It will also pull Instragram into the scope of testing.

Unfortunately it occasionally happens that Company A decides to do an integration between Salesforce and Company B, without telling Company B or checking to see whether Company B is willing to provide all the support necessary to go through the review (they may be tested themselves).

This is a good recipe for getting squeezed, as Instagram may not want to be integrated with Salesforce, and even if they do, it may not line up with their timelines. There are currently integrations between Salesforce and many third parties, such as Linked In, Citrix, Google, etc. But they all require full disclosure of source code being loaded on Salesforce servers as well as some kind of mutual test arrangement. Bottom line, it's not something that you can volunteer for the third party without their consent.

Make sure that you have everyone on board before going ahead with the integration. When companies like Instagram publish general connectors, it's often a take it or leave it proposition for publishers to decide to put on their own site. Instagram may not be willing to support the connector by providing source code or offering you the ability to test their API. That may be fine for your own website (or even your own Salesforce org), but if you are planning on publishing a generally available managed package then you do need the full cooperation of the third party behind the connector in the security review.

  • Thanks for the heads up, Robert. I'll definitely bring this up.
    – kev_panda
    Commented Nov 15, 2016 at 23:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .