I'm willing to bet the instagram app already signs their api requests to make sure they're coming from the app. Third party apps are reverse engineering that. If you try to send a request without those headers, it'll very likely give you a 4xx code.