The Instagram Graph API: a developer's guide
Today's Instagram API is Meta's Instagram Platform: one Graph API with two setups. Instagram API with Instagram Login works with a professional account alone and calls graph.instagram.com; Instagram API with Facebook Login needs a linked Facebook Page and calls graph.facebook.com. Personal accounts are not supported, and the old Basic Display API was shut down on December 4, 2024.
Updated:
What is the Instagram API in 2026?
The Instagram API is Meta's Instagram Platform: a set of Graph API endpoints for Instagram professional accounts. You choose one of two setups — Instagram API with Instagram Login (no Facebook Page, graph.instagram.com) or Instagram API with Facebook Login (account linked to a Page, graph.facebook.com). Both cover publishing, comments, insights and mentions; messaging and discovery features differ.
Meta launched the Instagram Login setup on July 23, 2024. Before that every integration went through a Facebook Page, which is why older tutorials still start with Page tokens.
The Instagram Basic Display API, once used to show a personal account's photos on a website, was deprecated on December 4, 2024, and every request to it now returns an error. For embedding public posts there is the oEmbed API, which since May 15, 2026 can be called without an access token.
On January 27, 2025 the old Instagram Login scope values (business_basic, business_content_publish, business_manage_comments, business_manage_messages) were retired in favour of the instagram_business_* names. If a login dialog suddenly rejects your scopes, check this first.
Instagram Login vs Facebook Login: which setup should you choose?
Both setups reach the same Instagram data, but they differ in login dialog, host, token type and a handful of features.
| Instagram Login | Facebook Login | |
|---|---|---|
| User logs in with | Instagram credentials | Facebook credentials |
| Facebook Page | Not required | Required, linked to the Instagram account |
| API host | graph.instagram.com | graph.facebook.com |
| Token | Instagram User access token | Facebook User or Page access token |
| Permission names | instagram_business_* | instagram_* plus pages_* |
| Publishing, comments, insights, mentions | Yes | Yes |
| Direct messaging | Yes | Via the Messenger Platform |
| Hashtag search, business discovery | No | Yes |
| Product tagging, partnership ads | No | Yes |
Rule of thumb: if you don't need hashtag search, other accounts' metadata or ads features, Instagram Login is simpler — your users don't need a Facebook Page.
Which Instagram accounts work with the API?
Only professional accounts — Business or Creator. Personal accounts can't be accessed through either setup, so the most common support ticket is solved by switching the account type in the Instagram app settings.
With Facebook Login the professional account must also be linked to a Facebook Page, and the person logging in needs a task on that Page. Some features add account conditions: Meta's Facebook Login documentation, for example, limits story publishing to business accounts.
The API always acts on behalf of an account that authorised your app. It is not a way to read arbitrary profiles: the only cross-account reads are hashtag search and business discovery, both Facebook Login only and both behind App Review.
What can you build with the Instagram API?
Content publishing
Images, Reels, carousels of up to 10 items and stories through a container → publish flow. Limit: 100 API-published posts per rolling 24 hours.
Comment moderation
Read, reply to, hide and delete comments, or turn comments off on a post. Private replies send one DM to a commenter within 7 days.
Messaging
Incoming Direct messages arrive via webhooks and you reply inside the 24-hour window; conversations and message history are readable through the API.
Insights
Account and media metrics. Some metrics are unavailable for accounts with fewer than 100 followers; account metrics are kept for up to 90 days.
Mentions
Find media where the account was @mentioned and get notified through the mentions webhook.
Hashtag search and business discovery
Facebook Login only. Up to 30 unique hashtags per account in a rolling 7-day period; requires the Instagram Public Content Access feature.
Instagram API permissions by feature
Request only what the feature needs — every extra permission is one more item to justify in App Review.
| Feature | Instagram Login | Facebook Login |
|---|---|---|
| Profile and media | instagram_business_basic | instagram_basic, pages_show_list |
| Publishing | instagram_business_basic, instagram_business_content_publish | instagram_basic, instagram_content_publish, pages_read_engagement |
| Comments and private replies | instagram_business_basic, instagram_business_manage_comments | instagram_basic, instagram_manage_comments, pages_read_engagement |
| Insights | instagram_business_basic, instagram_business_manage_insights | instagram_basic, instagram_manage_insights, pages_read_engagement |
| Messaging | instagram_business_basic, instagram_business_manage_messages | instagram_basic, instagram_manage_messages, pages_manage_metadata |
| Hashtag search | Not available | instagram_basic + Instagram Public Content Access |
With Facebook Login, if the person's Page role was granted through Business Manager, Meta also lists ads_management and ads_read for publishing, comments and insights.
Standard Access, Advanced Access and App Review
Every Business app starts with Standard Access to all of its permissions. That is enough for development and for apps that only work with accounts you own or manage, where users have a role on the app.
Advanced Access is required as soon as your app serves professional accounts you don't own or manage — in other words, any SaaS product. It is granted per permission through App Review, and Business Verification is mandatory.
Features are reviewed the same way. Human Agent (a person replying to DMs for up to 7 days) and Instagram Public Content Access (hashtag search) are features rather than permissions, and both need approval.
Two practical gotchas: the app must be in Live mode to receive webhook notifications, and comments and live_comments webhooks are delivered only with Advanced Access.
Instagram API rate limits at a glance
Instagram enforces several independent limits — hitting one doesn't block the others.
| Limit | Value | Scope |
|---|---|---|
| Business Use Case (BUC) | 4800 × impressions per 24 hours | Most Instagram Platform endpoints, per account |
| Platform Rate Limiting | Separate formula | Hashtag search and business discovery |
| Content publishing | 100 API-published posts per rolling 24 hours | Per account; a carousel counts as one post |
| Media containers | 400 per rolling 24 hours | Per account |
| Hashtag search | 30 unique hashtags per rolling 7 days | Per account |
| Conversations API | 2 calls per second | Per account |
| Send API | 100 calls/s for text, links, reactions, stickers; 10 calls/s for audio and video | Per account |
| Private replies | 750 calls/hour on posts and reels; 100 calls/s on Live | Per account |
Notes and limits
Impressions = the number of times the account's content entered someone's screen in the last 24 hours. BUC usage comes back in the X-Business-Use-Case-Usage response header; Instagram BUC throttling returns error code 80002.
How to get started with the Instagram API
Professional account
Switch the account to Business or Creator in the Instagram app settings. For Facebook Login, also link it to a Facebook Page.
Meta app
Create a Business-type app on developers.facebook.com and add the Instagram product. For Instagram Login choose "API setup with Instagram business login".
Redirect URI and scopes
Register the OAuth redirect URI and request only the permissions you need. The redirect_uri in the login URL and in the code exchange must match character for character.
Get a token
Exchange the code for a token on your server. For quick tests, the Instagram Login setup in the App Dashboard can generate a 60-day token for accounts added to the app.
First call
Instagram Login: GET graph.instagram.com/me?fields=user_id,username. Facebook Login: GET /me/accounts, then GET /{page-id}?fields=instagram_business_account.
Before launch
Subscribe to webhooks, switch the app to Live, and complete App Review and Business Verification to serve accounts you don't own.
How the two setups map to the Socialift SDK
In the Socialift Python SDK both setups use the same Instagram client; only the constructor and the token differ.
import asyncio, os
from socialift import Facebook, Instagram
async def main():
# 1) Instagram Login: no Page, graph.instagram.com, Instagram User token
async with Instagram.from_env() as ig:
me = await ig.profile(os.environ["IG_USER_TOKEN"])
print(me.username, me.followers_count)
# 2) Facebook Login: Page token + Instagram account ID read from the Page
async with Facebook.from_env() as fb, Instagram.via_facebook(
app_secret=os.environ["FACEBOOK_APP_SECRET"]
) as ig_fb:
for page in await fb.pages(os.environ["FB_USER_TOKEN"]):
if page.instagram_id:
posts = await ig_fb.media(page.access_token, ig_user_id=page.instagram_id, limit=5)
print(page.instagram_username, len(posts))
asyncio.run(main())Instagram.from_env() reads INSTAGRAM_APP_ID and INSTAGRAM_APP_SECRET, targets graph.instagram.com and expects an Instagram User token.
Instagram.via_facebook(app_secret=...) targets graph.facebook.com and expects a Page token. Here ig_user_id is required, because on graph.facebook.com me means the Page, not the Instagram account.
The SDK adds appsecret_proof to every request, raises RateLimitError (with retry_after) on Meta codes 4, 17, 32 and 613, and stores nothing — tokens live in your database. To try the methods against a real account, use the Playground in the dashboard.
Frequently asked questions
Can I use the Instagram API with a personal account?
No. Both Instagram API setups work only with professional accounts (Business or Creator). The owner can switch the account type in the Instagram app; for Facebook Login the account must also be linked to a Facebook Page.
Is the Instagram Basic Display API still available?
No. Meta deprecated it on December 4, 2024, and every request now returns an error. Use the Instagram API with Instagram Login for professional accounts, or oEmbed to embed public posts.
Do I need a Facebook Page to use the Instagram API?
Not with Instagram Login, which launched in July 2024. A Page is needed only for the Facebook Login setup — which is also the only way to get hashtag search, business discovery, product tagging and partnership ads.
Do I need App Review for the Instagram API?
Only for Advanced Access, which you need when the app serves accounts you don't own or manage. App Review runs per permission or feature and requires Business Verification. Testing with your own accounts works on Standard Access.
What are the Instagram API rate limits?
Most endpoints fall under Business Use Case limits: 4800 × the account's impressions per 24 hours. Feature limits sit on top, such as 100 API-published posts per 24 hours and 30 unique hashtags per 7 days. Messaging has per-second limits.