// app/vendor/mgp25/instagram-php/src/Client.php

class Client
{
    ...
    ...
    ...

    public function setToken($value)
    {
        $cookie = $this->getCookie('csrftoken', 'i.instagram.com');
        if ($cookie === null) {
            return false;
        }

        $cookie->setValue($value);

        return true;
    }

    ...
    ...
    ...
}

// app/vecdor/mgp25/instagram-php/src/Instagram.php

class Instagram implements ExperimentsInterface
{

    ...
    ...
    ...

    public function getToken() {
        return $this->client->getToken();
    }

    public function checkpointSelectChoice($api_path, $choice) {
        return $this->request($api_path)
            ->setNeedsAuth(false)
            ->addPost('choice', $choice)
            ->getDecodedResponse();
    }

    public function checkpointLogin($username, $password, $token, $account_id, $api_path, $security_code, $appRefreshInterval = 1800) {
        $this->_setUser($username, $password);
        $this->_sendPreLoginFlow();

        $this->client->setToken($token);

        $response = $this->request($api_path)
            ->setNeedsAuth(false)
            ->addPost('security_code', $security_code)
            ->getResponse(new Response\LoginResponse());

        $this->_updateLoginState($response);
        $this->_sendLoginFlow(true, $appRefreshInterval);

        return $response;
    }

    ...
    ...
    ...

}

// app/controllers/AccountController.php

class AccountController extends Controller
{

    ...
    ...
    ...

    private function save()
    {

        ...
        ...
        ...

        try {
            $login_resp = $Instagram->login($username, $password);

            if ($login_resp !== null && $login_resp->isTwoFactorRequired()) {
                $this->resp->result = 2;
                $this->resp->twofa_required = true;
                $this->resp->msg = __(
                    "Enter the code sent to your number ending in %s",
                    $login_resp->getTwoFactorInfo()->getObfuscatedPhoneNumber());
                $this->resp->identifier = $login_resp->getTwoFactorInfo()->getTwoFactorIdentifier();

                $_SESSION["2FA_".$this->resp->identifier] = [
                    "username" => $username,
                    "passhash" => $passhash,
                    "proxy" => $proxy
                ];
            } else if ($login_resp) {
                $logged_in = true;
            }
        } catch (InstagramAPI\Exception\CheckpointRequiredException $e) {
            if ($e->hasResponse() && $e->getResponse()->isCheckpointUrl()) {
                $url = $e->getResponse()->getCheckpointUrl();
                if (strpos($url, "dismiss") === false) {
                    $this->resp->msg = __("debug 1");
                }
                else {
                    $this->resp->msg = __("debug 2");
                }
            }
            else {
                $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
            }
        } catch (InstagramAPI\Exception\ChallengeRequiredException $e) {
            if ($e->hasResponse() && $e->getResponse()->isChallenge()) {
                try {
                    $api_path = ltrim($e->getResponse()->getChallenge()->getApiPath(), "/");

                    // email
                    $checkpoint_resp = $Instagram->checkpointSelectChoice($api_path, $choice = 1);
                    if ($checkpoint_resp["status"] != "ok") {
                        // phone
                        $checkpoint_resp = $Instagram->checkpointSelectChoice($api_path, $choice = 0);
                    }

                    if ($checkpoint_resp["status"] == "ok") {
                        $this->resp->result = 2;
                        $this->resp->checkpoint_required = true;
                        $this->resp->identifier = uniqid();

                        if ($choice) {
                            $this->resp->msg = __(
                                "Enter the 6-digit code sent to the email address %s",
                                $checkpoint_resp["step_data"]["contact_point"]);
                        }
                        else {
                            $this->resp->msg = __(
                                "Enter the code sent to your number ending in %s",
                                $checkpoint_resp["step_data"]["contact_point"]);
                        }

                        $_SESSION["CHECKPOINT_".$this->resp->identifier] = [
                            "token" => $Instagram->getToken(),
                            "user_id" => $checkpoint_resp["user_id"],
                            "api_path" => $api_path,
                            "username" => $username,
                            "password" => $password,
                            "passhash" => $passhash,
                            "proxy" => $proxy,
                            "is_system_proxy" => $is_system_proxy
                        ];
                    }
                    else {
                        $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
                    }
                } catch (InstagramAPI\Exception\InstagramException $e) {
                    if ($e->hasResponse()) {
                        $msg = $e->getResponse()->getMessage();
                    } else {
                        $msg = explode(":", $e->getMessage(), 2);
                        $msg = end($msg);
                    }
                    $this->resp->msg = $msg;
                } catch (\Exception $e) {
                    $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
                }
            }
            else {
                $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
            }
        } catch (InstagramAPI\Exception\AccountDisabledException $e) {
            $this->resp->msg = __(
                "Your account has been disabled for violating Instagram terms. <a href='%s'>Click here</a> to learn how you may be able to restore your account.",
                "https://help.instagram.com/366993040048856");
        } catch (InstagramAPI\Exception\SentryBlockException $e) {
            $this->resp->msg = __("Your account has been banned from Instagram API for spam behaviour or otherwise abusing.");
        } catch (InstagramAPI\Exception\IncorrectPasswordException $e) {
            $this->resp->msg = __("The password you entered is incorrect. Please try again.");
        } catch (InstagramAPI\Exception\InvalidUserException $e) {
            $this->resp->msg = __("The username you entered doesn't appear to belong to an account. Please check your username and try again.");
        } catch (InstagramAPI\Exception\InstagramException $e) {
            if ($e->hasResponse()) {
                $msg = $e->getResponse()->getMessage();
            } else {
                $msg = explode(":", $e->getMessage(), 2);
                $msg = end($msg);
            }
            $this->resp->msg = $msg;
        } catch (\Exception $e) {
            $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
        }

        ...
        ...
        ...

    }

    ...
    ...
    ...

    protected function checkpoint()
    {
        $this->resp->result = 0;

        $AuthUser = $this->getVariable("AuthUser");
        $Account = $this->getVariable("Account");

        // Check if this is new or not
        $is_new = !$Account->isAvailable();

        $security_code = Input::post("checkpoint-security-code");
        $checkpointid = Input::post("checkpointid");

        if (!isset(
            $_SESSION["CHECKPOINT_".$checkpointid]["token"],
            $_SESSION["CHECKPOINT_".$checkpointid]["user_id"],
            $_SESSION["CHECKPOINT_".$checkpointid]["api_path"],
            $_SESSION["CHECKPOINT_".$checkpointid]["username"],
            $_SESSION["CHECKPOINT_".$checkpointid]["password"],
            $_SESSION["CHECKPOINT_".$checkpointid]["passhash"]))
        {
            $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
            $this->resp->error_code = "account_invalid_identifier";
            $this->jsonecho();
        }

        $token = $_SESSION["CHECKPOINT_".$checkpointid]["token"];
        $user_id = $_SESSION["CHECKPOINT_".$checkpointid]["user_id"];
        $api_path = $_SESSION["CHECKPOINT_".$checkpointid]["api_path"];
        $username = $_SESSION["CHECKPOINT_".$checkpointid]["username"];
        $password = $_SESSION["CHECKPOINT_".$checkpointid]["password"];
        $passhash = $_SESSION["CHECKPOINT_".$checkpointid]["passhash"];
        $proxy = empty($_SESSION["CHECKPOINT_".$checkpointid]["proxy"])
               ? null : $_SESSION["CHECKPOINT_".$checkpointid]["proxy"];
        $is_system_proxy = $_SESSION["CHECKPOINT_".$checkpointid]["is_system_proxy"];

        // Setup Instagram Client
        // Allow web usage
        // Since mentioned risks has been consider internally by Nextpost,
        // setting this property value to the true is not risky as it's name
        \InstagramAPI\Instagram::$allowDangerousWebUsageAtMyOwnRisk = true;

        $storageConfig = [
            "storage" => "file",
            "basefolder" => SESSIONS_PATH."/".$AuthUser->get("id")."/",
        ];

        $Instagram = new \InstagramAPI\Instagram(false, false, $storageConfig);
        $Instagram->setVerifySSL(SSL_ENABLED);

        if ($proxy) {
            $Instagram->setProxy($proxy);
        }

        try {
            $login_resp = $Instagram->checkpointLogin($username, $password, $token, $user_id, $api_path, $security_code);
            if ($login_resp->getStatus() == "ok") {
                $Account->set("user_id", $AuthUser->get("id"))
                        ->set("password", $passhash)
                        ->set("proxy", $proxy ? $proxy : "")
                        ->set("login_required", 0)
                        ->set("instagram_id", $login_resp->getLoggedInUser()->getPk())
                        ->set("username", $login_resp->getLoggedInUser()->getUsername())
                        ->set("login_required", 0)
                        ->save();

                // Update proxy use count
                if ($proxy && $is_system_proxy == true) {
                    $Proxy = Controller::model("Proxy", $proxy);
                    if ($Proxy->isAvailable()) {
                        $Proxy->set("use_count", $Proxy->get("use_count") + 1)
                            ->save();
                    }
                }

                $this->resp->result = 1;
                if ($is_new) {
                    $this->resp->redirect = APPURL."/accounts";
                } else {
                    $this->resp->changes_saved = true;
                    $this->resp->msg = __("Changes saved!");
                }
            }
            else {
                $this->resp->msg = __("Please check the code sent to you and try again.");
            }
        } catch (InstagramAPI\Exception\InstagramException $e) {
            if ($e->hasResponse()) {
                $msg = $e->getResponse()->getMessage();
            } else {
                $msg = explode(":", $e->getMessage(), 2);
                $msg = end($msg);
            }
            $this->resp->msg = $msg;
        } catch (\Exception $e) {
            $this->resp->msg = __("Oops! Something went wrong. Please try again later!");
        }

        $this->jsonecho();
    }

    ...
    ...
    ...

}