What happens when you click on a live video on Instagram

unlink your FB account from Instagram

1. Go to Instagram settings.
2. Click on linked accounts.
3. Unlink the facebook.

Yes, API tokens should be kept private. Think of them as a replacement for your username and password. It's another way of authenticating who you are and what type of access you should have.

As for what can be done with any particular API token, this varies from service to service. Some services allow you to create API tokens with limited access, some only have one level of access.

Some sites provide API tokens with limited or public access with the idea being you can use these to experiment with and learn your way around their API. These usually only have 'read' but no 'write' access.