{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"376b33b46c4056a40f80b4ad4cfb3ff1036d875f46abb4ce6934217c0a944ba4","entry":{"id":"meta/instagram-graph","name":"Instagram Platform API (Graph API for professional accounts)","vendor":"Meta","summary":"Publish media, manage comments and messages and read insights for Instagram professional (business or creator) accounts. Free to call, but serving accounts you do not own needs Advanced Access, which needs App Review and Business Verification.","aliases":["instagram-graph-api","instagram-api","instagram-business-api","instagram-platform"],"category":"social","group":"B","homepage":"https://developers.facebook.com/docs/instagram-platform/","docs":["https://developers.facebook.com/docs/instagram-platform/overview","https://developers.facebook.com/documentation/instagram-platform/create-an-instagram-app.md","https://developers.facebook.com/documentation/instagram-platform/app-review.md"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"ig-overview","url":"https://developers.facebook.com/docs/instagram-platform/overview","title":"Instagram Platform – Overview","accessed":"2026-10-25","supports":"Two API setups (Instagram Login vs Facebook Login) and Unified Login; professional account required; Page link and Page admin-equivalent tasks for the Facebook Login setup; Standard vs Advanced Access; Advanced Access needs App Review and Business Verification; token lifetimes (code 1 h, short-lived 1 h, long-lived 60 days); permission names; rate-limit formula 4800 x impressions per 24 h","kind":"official"},{"id":"ig-create-app","url":"https://developers.facebook.com/documentation/instagram-platform/create-an-instagram-app.md","title":"Instagram Platform – Create an Instagram app","accessed":"2026-10-25","supports":"Use case Other, app type Business required for the Instagram product; app must be connected to a business that has completed Business Verification before publishing; 15-app role limit; tester accounts must be public; redirect, deauthorize and data-deletion URLs in business login settings; App Review needed before live data","kind":"official"},{"id":"ig-app-review","url":"https://developers.facebook.com/documentation/instagram-platform/app-review.md","title":"Instagram Platform – App Review","accessed":"2026-10-25","supports":"App Review only needed for Advanced Access (tech providers serving other businesses); screencast per permission; privacy policy URL, 1024x1024 icon, category and business email; at least one successful API call per permission; Facebook Login or Instagram Login but not both; unused permissions rejected","kind":"official"},{"id":"ig-ig-login","url":"https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login","title":"Instagram API with Instagram Login","accessed":"2026-10-25","supports":"No Facebook Page needed; cannot access ads or tagging; instagram_business_* scopes replace business_* (old values deprecated 27 January 2025)","kind":"official"},{"id":"ig-refresh","url":"https://developers.facebook.com/documentation/instagram-platform/reference/refresh_access_token.md","title":"Instagram Platform – Refresh access token","accessed":"2026-10-25","supports":"Long-lived token can be refreshed when at least 24 hours old and unexpired, needs instagram_business_basic; refreshed token valid 60 days","kind":"official"},{"id":"ig-publish-limit","url":"https://developers.facebook.com/documentation/instagram-platform/instagram-graph-api/reference/ig-user/content_publishing_limit.md","title":"IG User content_publishing_limit","accessed":"2026-10-25","supports":"Publishing quota currently 50 containers per 24 hours per account","kind":"official"},{"id":"access-levels","url":"https://developers.facebook.com/docs/graph-api/overview/access-levels","title":"Graph API – Access levels","accessed":"2026-10-25","supports":"Standard Access only for people with a role on the app; Advanced Access granted per permission via App Review; Data Use Checkup required for apps with Advanced Access","kind":"official"},{"id":"duc-blog","url":"https://developers.facebook.com/blog/post/2020/09/10/data-use-checkup-rolling-out-broadly-facebook-platform-developers/","title":"Meta for Developers blog – Data Use Checkup rolling out broadly","accessed":"2026-10-25","supports":"Data Use Checkup is an annual certification; apps that miss the deadline lose access to the relevant platform features","kind":"official"},{"id":"devpolicy","url":"https://developers.facebook.com/devpolicy/","title":"Meta Developer Policies","accessed":"2026-10-25","supports":"2.7 no programs that buy, sell or exchange likes or followers; 1.7 consent before acting on someone's behalf; 5.2(a) no Instagram messaging without consent; 6.2 Instagram Platform rules","kind":"official"},{"id":"platform-terms","url":"https://developers.facebook.com/terms/","title":"Meta Platform Terms","accessed":"2026-10-25","supports":"3.a.iv no selling, licensing or buying Platform Data; 4.a privacy policy required; 3.d deletion on request; 6.a.iv protect and never share access tokens or app secrets; 7.e enforcement may suspend or permanently remove apps and accounts, with or without notice","kind":"official"},{"id":"forum-13-days","url":"https://developers.facebook.com/community/threads/3459359287566790/","title":"Meta developer community – App Review stuck at 13 days (instagram_business_basic + instagram_business_manage_messages)","accessed":"2026-10-25","supports":"Developer report of an Instagram App Review in review for 13 days with no feedback","kind":"community"},{"id":"bundle-social","url":"https://bundle.social/blog/meta-app-review-20-days","title":"bundle.social – Meta App Review taking 20 days (July 2026)","accessed":"2026-10-25","supports":"Third-party report that Meta App Review times drifted from 1-3 days (pre-2025) to around 20 days by mid-2026; common Instagram rejection causes (unused permissions, vague notes, weak screencasts, broken test logins, Business Verification name mismatches). States the timeline is not official.","kind":"community"}],"allowed_domains":["developers.facebook.com","business.facebook.com","instagram.com","facebook.com"],"account_model":{"summary":"A Meta developer account creates a Business-type app, connected to a Business Portfolio that has passed Business Verification. Each Instagram account the app serves must be a professional (business or creator) account. With the Facebook Login setup, that Instagram account is also linked to a Facebook Page the user can administer.","accounts":[{"name":"Meta developer account","kind":"developer","owned_by":"the person","required":true,"note":"Holds a developer or admin role on at most 15 apps."},{"name":"Meta Business Portfolio (verified)","kind":"organisation","owned_by":"the business","required":true,"note":"Must have completed Business Verification before the app can be published."},{"name":"Business-type Meta app with the Instagram product","kind":"project","parent":"Meta Business Portfolio (verified)","required":true},{"name":"Instagram professional account","kind":"other","owned_by":"the account holder (you, or each client business)","required":true,"note":"Business or creator account. Test accounts added to the app must be public."},{"name":"Facebook Page","kind":"other","owned_by":"the account holder","parent":"Instagram professional account","required":false,"note":"Only for the Instagram API with Facebook Login setup; the user must be able to do admin-equivalent tasks on it."}],"notes":["Two setups. Instagram Login (graph.instagram.com, instagram_business_* scopes) needs no Page but has no hashtag search, product tagging, ads or tagging. Facebook Login (graph.facebook.com, instagram_* plus pages_* scopes) needs a Page-linked account. An app uses one or the other, not both. Meta recommends Unified Login for new integrations.","Standard Access (default) works only for accounts with a role on the app, i.e. your own accounts. Serving other people's accounts needs Advanced Access per permission."]},"prerequisites":[{"entry":"meta/developer-app","note":"A Business-type app (use case Other) is required to add the Instagram product."},{"entry":"meta/business-portfolio"},{"entry":"meta/business-verification","note":"Needed before publishing and for Advanced Access to serve accounts you do not own."},{"entry":"meta/app-review","note":"Only for Advanced Access (tech providers serving other businesses)."},{"entry":"meta/facebook-login","note":"Only if you choose the Facebook Login (Page-linked) setup."}],"identity_requires":["legal_name","website","privacy_policy_url","support_email","app_icon_url"],"have_ready":[{"kind":"other","description":"An Instagram professional (business or creator) account set to public, for testing","why":"Tester accounts assigned to the app must be public professional accounts","needed_for":["testers-and-tokens"],"auto_check":"none","source":"ig-create-app"},{"kind":"other","description":"A Facebook Page linked to the Instagram account, with admin-equivalent access (Facebook Login setup only)","needed_for":["choose-setup"],"auto_check":"none","source":"ig-overview"},{"kind":"app_privacy_policy_url","description":"Public privacy policy URL that explains how users request deletion of their data","needed_for":["app-settings"],"auto_check":"website_live","source":"ig-app-review"},{"kind":"app_icon","description":"App icon, 1024 x 1024 pixels","needed_for":["app-settings"],"auto_check":"none","source":"ig-app-review"},{"kind":"domain_email","description":"Business contact email; it receives App Review results and developer alerts","needed_for":["app-settings"],"auto_check":"domain_email_mx","source":"ig-app-review"},{"kind":"live_website","description":"A web app reviewers can load and test from outside your network, with a visible Instagram login button, plus HTTPS redirect, deauthorize and data-deletion URLs","why":"Web is currently the only platform for Instagram API with Instagram Login; untestable submissions are rejected","needed_for":["business-login-settings","app-review"],"auto_check":"website_live","source":"ig-app-review"},{"kind":"demo_video","description":"One screencast per requested permission showing the end-to-end user flow (English UI, captions)","needed_for":["app-review"],"auto_check":"none","source":"ig-app-review"},{"kind":"other","description":"Test login credentials for your app that do not hit 2FA or email-verification walls","needed_for":["app-review"],"auto_check":"none","source":"bundle-social"}],"steps":[{"id":"professional-account","title":"Make sure each Instagram account is a professional account","summary":"The account you will publish or read for must be an Instagram business or creator account. For testing it must also be public. You switch this in the Instagram app settings yourself.","route":"guided","depends_on":[],"gate":"human_login","sources":["ig-overview","ig-create-app"]},{"id":"choose-setup","title":"Choose Instagram Login or Facebook Login","summary":"Pick one. Instagram Login needs no Facebook Page and covers publishing, comments, messages and insights. Pick Facebook Login if you need hashtag search, product tagging or Page-linked features, and link the Instagram account to a Facebook Page you administer. You cannot use both in one app.","route":"guided","depends_on":["professional-account"],"gate":"none","sources":["ig-overview","ig-ig-login","ig-app-review"]},{"id":"create-app","title":"Create a Business-type app and add the Instagram product","summary":"In the App Dashboard create an app, connect your business portfolio, choose use case Other and app type Business, enter a name and contact email, then press Set up on the Instagram product. There is no official API to create apps.","route":"guided","depends_on":["choose-setup"],"gate":"human_submit","url":"https://developers.facebook.com/apps/","recovery":[{"hiccup":"Cannot create another app","fix":"You can hold a developer or admin role on at most 15 apps; archive or remove unused apps first.","source":"ig-create-app"},{"hiccup":"Instagram product not offered","fix":"The app must be type Business. Create a new app with use case Other and type Business.","source":"ig-create-app"}],"sources":["ig-create-app"]},{"id":"app-settings","title":"Fill in App settings > Basic","summary":"Add the privacy policy URL, a 1024x1024 icon, an app category and a business email. Copy the App ID; the App Secret stays secret.","route":"guided","depends_on":["create-app"],"gate":"human_submit","url":"https://developers.facebook.com/apps/","preflight":["privacy_policy_reachable","app_icon_present"],"sources":["ig-app-review"]},{"id":"testers-and-tokens","title":"Add your Instagram account as a tester and generate a test token","summary":"Under Instagram > API setup, assign your public professional account. The account holder accepts the tester invite and logs in; a token is generated for testing API calls and webhooks. This token works without App Review for accounts with a role on the app (Standard Access).","route":"guided","depends_on":["app-settings"],"gate":"human_login","url":"https://developers.facebook.com/apps/","lead_time":{"typical_minutes":10},"capture":{"env":"INSTAGRAM_ACCESS_TOKEN","kind":"token"},"sources":["ig-create-app","access-levels"]},{"id":"business-login-settings","title":"Set up business login (redirect, deauthorize and data-deletion URLs)","summary":"Add your OAuth redirect URL plus deauthorize callback and data deletion request URL in the business login settings. Optionally configure webhooks with a callback URL and verify token.","route":"guided","depends_on":["app-settings"],"gate":"human_submit","sources":["ig-create-app"]},{"id":"business-verification","title":"Complete Business Verification for the connected portfolio","summary":"Needed before you can publish the app and for Advanced Access. Follow the meta/business-verification entry. Only needed if you will serve Instagram accounts that do not have a role on your app.","route":"guided","depends_on":["create-app"],"gate":"third_party_review","optional":true,"sources":["ig-create-app","ig-overview"]},{"id":"app-review","title":"Request Advanced Access through App Review","summary":"Only for apps that serve other businesses' accounts. For each permission (for example instagram_business_basic, instagram_business_content_publish), make at least one successful API call, describe the use case step by step, upload a screencast and give test credentials. Request only permissions the app visibly uses.","route":"guided","depends_on":["business-login-settings","business-verification","testers-and-tokens"],"gate":"third_party_review","url":"https://developers.facebook.com/apps/","lead_time":{"official":{"text":"Meta's Instagram App Review page gives no review time [to verify in the App Dashboard at submission]","source":"ig-app-review"},"reported":{"text":"Community reports range from a few days to about three weeks; one Instagram submission sat 13 days with no feedback, and a July 2026 third-party write-up describes roughly 20 days. Each resubmission restarts the wait.","source":"forum-13-days"}},"recovery":[{"hiccup":"Rejected because a permission is not used or does not match its allowed use","fix":"Remove permissions the app does not visibly use today; include any permission another one depends on.","source":"ig-app-review"},{"hiccup":"Entire submission rejected because reviewers could not access the app","fix":"Make the app load from outside your network, give working test credentials without 2FA or email walls, and step-by-step login instructions.","source":"ig-app-review"},{"hiccup":"Screencast judged unclear","fix":"Record the whole flow for each permission, English UI where possible, with captions explaining non-obvious buttons.","source":"ig-app-review"},{"hiccup":"Advanced permissions blocked by Business Verification name mismatch","fix":"Make the legal name on the verification documents match the Business Portfolio details exactly, then resubmit.","source":"bundle-social"}],"optional":true,"sources":["ig-app-review","access-levels"]},{"id":"go-live","title":"Switch the app to Live and exchange long-lived tokens","summary":"After approval, publish the app. In production, exchange each authorization code (valid 1 hour) for a short-lived token (1 hour), then a long-lived token (60 days), stored server-side and refreshed before expiry.","route":"guided","depends_on":["app-review"],"gate":"human_submit","optional":true,"sources":["ig-overview","ig-refresh"]}],"outputs":[{"name":"INSTAGRAM_APP_ID","description":"Instagram app ID shown under the Instagram product API setup (Instagram Login), or the Meta App ID for the Facebook Login setup","secret":false,"example_format":"1234567890123456","from_step":"create-app"},{"name":"INSTAGRAM_APP_SECRET","description":"Instagram app secret (server-side only)","secret":true,"example_format":"32 hex characters","from_step":"create-app"},{"name":"INSTAGRAM_ACCESS_TOKEN","description":"Instagram User access token (long-lived, 60 days, refreshable) for your own professional account","secret":true,"example_format":"IG…","environments":["development","production"],"from_step":"testers-and-tokens"},{"name":"INSTAGRAM_USER_ID","description":"Id of the Instagram professional account (IG User id) used in API paths","secret":false,"example_format":"17841400000000000"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"No buying or selling engagement","text":"Meta's Developer Policies (2.7) forbid taking part in any programme that buys, sells or exchanges likes, followers or similar metrics. Growth or \"engagement\" tools built on the API risk app removal.","source":"devpolicy"},{"kind":"rules_say","severity":"red","title":"Consent before acting or messaging","text":"You must get people's consent before publishing or taking any other action on their behalf (1.7), and must not contact people in Instagram Messaging without legally sufficient consent (5.2(a)).","source":"devpolicy"},{"kind":"rules_say","severity":"red","title":"Platform data is not for sale; tokens are not to be shared","text":"The Platform Terms ban selling, licensing or buying Platform Data (3.a.iv) and require you to protect and never transfer, share or solicit access tokens or app secrets (6.a.iv). Meta may suspend or permanently remove apps and accounts, with or without notice (7.e). Plain-English summary, not legal advice.","source":"platform-terms"},{"kind":"rules_say","severity":"amber","title":"Annual Data Use Checkup","text":"Apps with Advanced Access must complete Data Use Checkup every year; apps that miss the deadline lose access to the relevant features and may need App Review again.","source":"duc-blog"},{"kind":"rules_say","severity":"yellow","title":"Publishing quota","text":"An account can publish at most 50 containers via the API per rolling 24 hours (current value; Meta may change it).","source":"ig-publish-limit"},{"kind":"people_report","severity":"amber","title":"Review waits are getting longer","text":"Developers report Instagram App Review taking from several days to around three weeks in 2026, with resubmissions restarting the clock. Plan launch dates with slack. Community reports, not Meta figures.","source":"bundle-social"}],"renewals":[{"what":"Long-lived Instagram User access token (refresh when at least 24 hours old and before expiry)","every":"60 days","every_days":60,"source":"ig-refresh"},{"what":"Data Use Checkup for apps with Advanced Access","every":"1 year","every_days":365,"source":"duc-blog"}],"pricing_notes":{"notes":"The overview states no price for API calls [to verify]. Usage is governed by rate limits (calls per 24 h = 4800 x number of impressions per app-user pair) rather than price.","source":"ig-overview"},"api_provisioning":{"available":"partial","notes":"Apps, products, App Review and Business Verification are dashboard-only. Tokens are obtained through the OAuth flows and the token exchange and refresh endpoints.","docs":["https://developers.facebook.com/documentation/instagram-platform/reference/refresh_access_token.md"],"source":"ig-refresh"},"detect":{"env_names":["INSTAGRAM_APP_ID","INSTAGRAM_APP_SECRET","INSTAGRAM_ACCESS_TOKEN","IG_ACCESS_TOKEN"]}}}