No buying or selling engagement
Meta's Developer Policies (2.7) forbid taking part in any programme that buys, sells or exchanges likes, followers or similar metrics. Growth or "engagement" tools built on the API risk app removal. [9]
Guides · social · Verification-gated
Instagram Platform API (Graph API for professional accounts)
Publish media, manage comments and messages and read insights for Instagram professional (business or creator) accounts. Free to call, but serving accounts you do not own needs Advanced Access, which needs App Review and Business Verification.
Researched · not yet run liveLast researched 25 October 2026 · Meta · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
A Meta developer account creates a Business-type app, connected to a Business Portfolio that has passed Business Verification. Each Instagram account the app serves must be a professional (business or creator) account. With the Facebook Login setup, that Instagram account is also linked to a Facebook Page the user can administer.
- Meta developer account developer owned by the personHolds a developer or admin role on at most 15 apps.
- Meta Business Portfolio (verified) organisation owned by the businessMust have completed Business Verification before the app can be published.
- Business-type Meta app with the Instagram product project · under Meta Business Portfolio (verified)
- Instagram professional account other owned by the account holder (you, or each client business)Business or creator account. Test accounts added to the app must be public.
- Facebook Page otheroptional owned by the account holder · under Instagram professional accountOnly for the Instagram API with Facebook Login setup; the user must be able to do admin-equivalent tasks on it.
Two setups. Instagram Login (graph.instagram.com, instagram_business_* scopes) needs no Page but has no hashtag search, product tagging, ads or tagging. Facebook Login (graph.facebook.com, instagram_* plus pages_* scopes) needs a Page-linked account. An app uses one or the other, not both. Meta recommends Unified Login for new integrations.
Standard Access (default) works only for accounts with a role on the app, i.e. your own accounts. Serving other people's accounts needs Advanced Access per permission.
Have ready
- meta/developer-app: A Business-type app (use case Other) is required to add the Instagram product.
- meta/business-portfolio
- meta/business-verification: Needed before publishing and for Advanced Access to serve accounts you do not own.
- meta/app-review: Only for Advanced Access (tech providers serving other businesses).
- meta/facebook-login: Only if you choose the Facebook Login (Page-linked) setup.
- An Instagram professional (business or creator) account set to public, for testing · Tester accounts assigned to the app must be public professional accounts [2]Needed for: Add your Instagram account as a tester and generate a test token
- A Facebook Page linked to the Instagram account, with admin-equivalent access (Facebook Login setup only) [1]Needed for: Choose Instagram Login or Facebook Login
- Public privacy policy URL that explains how users request deletion of their data [3]Needed for: Fill in App settings > Basic
- App icon, 1024 x 1024 pixels [3]Needed for: Fill in App settings > Basic
- Business contact email; it receives App Review results and developer alerts [3]Needed for: Fill in App settings > Basic
- A web app reviewers can load and test from outside your network, with a visible Instagram login button, plus HTTPS redirect, deauthorize and data-deletion URLs · Web is currently the only platform for Instagram API with Instagram Login; untestable submissions are rejected [3]Needed for: Set up business login (redirect, deauthorize and data-deletion URLs), Request Advanced Access through App Review
- One screencast per requested permission showing the end-to-end user flow (English UI, captions) [3]Needed for: Request Advanced Access through App Review
- Test login credentials for your app that do not hit 2FA or email-verification walls [12]Needed for: Request Advanced Access through App Review
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Make sure each Instagram account is a professional account
The account you will publish or read for must be an Instagram business or creator account. For testing it must also be public. You switch this in the Instagram app settings yourself.
Choose Instagram Login or Facebook Login
Pick one. Instagram Login needs no Facebook Page and covers publishing, comments, messages and insights. Pick Facebook Login if you need hashtag search, product tagging or Page-linked features, and link the Instagram account to a Facebook Page you administer. You cannot use both in one app.
Create a Business-type app and add the Instagram product
In the App Dashboard create an app, connect your business portfolio, choose use case Other and app type Business, enter a name and contact email, then press Set up on the Instagram product. There is no official API to create apps.
If something goes wrong (2)
Where: https://developers.facebook.com/apps/
Fill in App settings > Basic
Add the privacy policy URL, a 1024x1024 icon, an app category and a business email. Copy the App ID; the App Secret stays secret.
Where: https://developers.facebook.com/apps/
Add your Instagram account as a tester and generate a test token
Under Instagram > API setup, assign your public professional account. The account holder accepts the tester invite and logs in; a token is generated for testing API calls and webhooks. This token works without App Review for accounts with a role on the app (Standard Access).
- Your time
- about 10 min
verapli captures
INSTAGRAM_ACCESS_TOKENhere by plain code: encrypted in your browser, never shown to AI.Where: https://developers.facebook.com/apps/
Set up business login (redirect, deauthorize and data-deletion URLs)
Add your OAuth redirect URL plus deauthorize callback and data deletion request URL in the business login settings. Optionally configure webhooks with a callback URL and verify token.
Complete Business Verification for the connected portfoliooptional
Needed before you can publish the app and for Advanced Access. Follow the meta/business-verification entry. Only needed if you will serve Instagram accounts that do not have a role on your app.
Request Advanced Access through App Reviewoptional
Only for apps that serve other businesses' accounts. For each permission (for example instagram_business_basic, instagram_business_content_publish), make at least one successful API call, describe the use case step by step, upload a screencast and give test credentials. Request only permissions the app visibly uses.
- The provider says
- Meta's Instagram App Review page gives no review time [to verify in the App Dashboard at submission] [3]
- People report
- Community reports range from a few days to about three weeks; one Instagram submission sat 13 days with no feedback, and a July 2026 third-party write-up describes roughly 20 days. Each resubmission restarts the wait. [11]
If something goes wrong (4)
- Rejected because a permission is not used or does not match its allowed use: Remove permissions the app does not visibly use today; include any permission another one depends on. [3]
- Entire submission rejected because reviewers could not access the app: Make the app load from outside your network, give working test credentials without 2FA or email walls, and step-by-step login instructions. [3]
- Screencast judged unclear: Record the whole flow for each permission, English UI where possible, with captions explaining non-obvious buttons. [3]
- Advanced permissions blocked by Business Verification name mismatch: Make the legal name on the verification documents match the Business Portfolio details exactly, then resubmit. [12]
Where: https://developers.facebook.com/apps/
Switch the app to Live and exchange long-lived tokensoptional
After approval, publish the app. In production, exchange each authorization code (valid 1 hour) for a short-lived token (1 hour), then a long-lived token (60 days), stored server-side and refreshed before expiry.
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Consent before acting or messaging
You must get people's consent before publishing or taking any other action on their behalf (1.7), and must not contact people in Instagram Messaging without legally sufficient consent (5.2(a)). [9]
Platform data is not for sale; tokens are not to be shared
The Platform Terms ban selling, licensing or buying Platform Data (3.a.iv) and require you to protect and never transfer, share or solicit access tokens or app secrets (6.a.iv). Meta may suspend or permanently remove apps and accounts, with or without notice (7.e). Plain-English summary, not legal advice. [10]
Annual Data Use Checkup
Apps with Advanced Access must complete Data Use Checkup every year; apps that miss the deadline lose access to the relevant features and may need App Review again. [8]
Publishing quota
An account can publish at most 50 containers via the API per rolling 24 hours (current value; Meta may change it). [6]
Review waits are getting longer
Developers report Instagram App Review taking from several days to around three weeks in 2026, with resubmissions restarting the clock. Plan launch dates with slack. Community reports, not Meta figures. [12]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
INSTAGRAM_APP_ID | not secret | 1234567890123456 | Instagram app ID shown under the Instagram product API setup (Instagram Login), or the Meta App ID for the Facebook Login setup |
INSTAGRAM_APP_SECRET | secret | 32 hex characters | Instagram app secret (server-side only) |
INSTAGRAM_ACCESS_TOKEN | secret | IG… | Instagram User access token (long-lived, 60 days, refreshable) for your own professional account |
INSTAGRAM_USER_ID | not secret | 17841400000000000 | Id of the Instagram professional account (IG User id) used in API paths |
Renewals
- Long-lived Instagram User access token (refresh when at least 24 hours old and before expiry): every 60 days [5]
- Data Use Checkup for apps with Advanced Access: every 1 year [8]
Pricing
- The overview states no price for API calls [to verify]. Usage is governed by rate limits (calls per 24 h = 4800 x number of impressions per app-user pair) rather than price.
Source [1]
For agents
The same entry as JSON: /api/v1/entries/meta/instagram-graph · requirements /api/v1/requirements/meta/instagram-graph · terms /api/v1/terms/meta/instagram-graph.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Instagram Platform API (Graph API for professional accounts), and how long will it take?"
→ tools/call requirements { "provider_id": "meta/instagram-graph" }Sources
- Instagram Platform – Overview Two API setups (Instagram Login vs Facebook Login) and Unified Login; professional account required; Page link and Page admin-equivalent tasks for the Facebook Login setup; Standard vs Advanced Access; Advanced Access needs App Review and Business Verification; token lifetimes (code 1 h, short-lived 1 h, long-lived 60 days); permission names; rate-limit formula 4800 x impressions per 24 h · accessed 25 October 2026 · official
- Instagram Platform – Create an Instagram app Use case Other, app type Business required for the Instagram product; app must be connected to a business that has completed Business Verification before publishing; 15-app role limit; tester accounts must be public; redirect, deauthorize and data-deletion URLs in business login settings; App Review needed before live data · accessed 25 October 2026 · official
- Instagram Platform – App Review App Review only needed for Advanced Access (tech providers serving other businesses); screencast per permission; privacy policy URL, 1024x1024 icon, category and business email; at least one successful API call per permission; Facebook Login or Instagram Login but not both; unused permissions rejected · accessed 25 October 2026 · official
- Instagram API with Instagram Login No Facebook Page needed; cannot access ads or tagging; instagram_business_* scopes replace business_* (old values deprecated 27 January 2025) · accessed 25 October 2026 · official
- Instagram Platform – Refresh access token Long-lived token can be refreshed when at least 24 hours old and unexpired, needs instagram_business_basic; refreshed token valid 60 days · accessed 25 October 2026 · official
- IG User content_publishing_limit Publishing quota currently 50 containers per 24 hours per account · accessed 25 October 2026 · official
- Graph API – Access levels Standard Access only for people with a role on the app; Advanced Access granted per permission via App Review; Data Use Checkup required for apps with Advanced Access · accessed 25 October 2026 · official
- Meta for Developers blog – Data Use Checkup rolling out broadly Data Use Checkup is an annual certification; apps that miss the deadline lose access to the relevant platform features · accessed 25 October 2026 · official
- Meta Developer Policies 2.7 no programs that buy, sell or exchange likes or followers; 1.7 consent before acting on someone's behalf; 5.2(a) no Instagram messaging without consent; 6.2 Instagram Platform rules · accessed 25 October 2026 · official
- Meta Platform Terms 3.a.iv no selling, licensing or buying Platform Data; 4.a privacy policy required; 3.d deletion on request; 6.a.iv protect and never share access tokens or app secrets; 7.e enforcement may suspend or permanently remove apps and accounts, with or without notice · accessed 25 October 2026 · official
- Meta developer community – App Review stuck at 13 days (instagram_business_basic + instagram_business_manage_messages) Developer report of an Instagram App Review in review for 13 days with no feedback · accessed 25 October 2026 · community
- bundle.social – Meta App Review taking 20 days (July 2026) Third-party report that Meta App Review times drifted from 1-3 days (pre-2025) to around 20 days by mid-2026; common Instagram rejection causes (unused permissions, vague notes, weak screencasts, broken test logins, Business Verification name mismatches). States the timeline is not official. · accessed 25 October 2026 · community
Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Meta is not affiliated with verapli.