How to Get an Instagram Access Token (Long-Lived, 2026 Guide)

November 9, 2026

Short answer

To get an Instagram access token, create a Business-type Meta app, add the Instagram product with API setup with Instagram login, send a professional account through the OAuth window, and swap the returned code for a short-lived token that lasts one hour. Exchange it for a long-lived token that lasts 60 days, and refresh it any time after it is 24 hours old and before it expires.

An Instagram access token is the string that lets your app read or manage one Instagram professional account through Meta's API. Personal accounts are out: the Basic Display API, which served them, stopped working on 4 December 2024 (Meta's notice). This guide covers the route most new apps want, the Instagram API with Instagram Login. For what the API costs and what it cannot read, see Is the Instagram API free?

Instagram Login or Facebook Login: pick first

Meta offers two setups, and the token you get depends on which one you choose (Meta's overview).

	Instagram API with Instagram Login	Instagram API with Facebook Login for Business
Facebook Page needed	No	Yes, linked to the Instagram account
Token you get	Instagram User access token	Facebook User or Page access token
API host	graph.instagram.com	graph.facebook.com
Hashtag search, product tagging, partnership ads	No	Yes
Publishing, comments, insights, mentions	Yes	Yes

If you need an Instagram access token without a Facebook Page, Instagram Login is the answer. If you need hashtag search or ads, use Facebook Login and follow our Facebook Graph API token guide instead.

What you need

An Instagram professional account (Business or Creator). The API is built for businesses and creators (Meta).
A Meta developer account.
An HTTPS redirect URL on a server you control.
A verified business, before you publish the app. You can add it later in App settings > Basic.

How to get an Instagram access token, step by step

Create the app. In the Meta app dashboard, click Create App. Connecting a business is optional at this point.
Pick the use case and type. Choose the use case "Other", then the app type "Business". Meta's setup guide says only business apps can add the Instagram product.
Add Instagram. Enter an app name and contact email, then on the Instagram product click Set up. "API setup with Instagram login" is added for you.
Add a test account. Under Generate access tokens, add your Instagram professional account and log in to it. Roles are managed in App Roles > Roles.
Set up business login. In section "3. Set up Instagram business login", click Set up, add your redirect URL, and copy the Embed URL. The same settings hold the deauthorize and data deletion callback URLs.
Send the user through OAuth. Open the Embed URL, or build it yourself (below). After consent, Instagram redirects back with a code.
Swap the code for tokens. Exchange it for a short-lived token, then for a long-lived one, on your server.

The OAuth flow in curl

All three calls come from Meta's business login docs.

1. Authorization URL. Send the user here. The code you get back is valid for one hour and works once. Strip the trailing #_ before you use it.

https://www.instagram.com/oauth/authorize?client_id=APP_ID&redirect_uri=https://example.com/ig/callback&response_type=code&scope=instagram_business_basic

2. Short-lived token.

curl -X POST "https://api.instagram.com/oauth/access_token" \
  -F client_id=APP_ID \
  -F client_secret=APP_SECRET \
  -F grant_type=authorization_code \
  -F redirect_uri=https://example.com/ig/callback \
  -F code=CODE

3. Long-lived token. Do this server-side only, because it needs your app secret.

curl "https://graph.instagram.com/access_token?grant_type=ig_exchange_token&client_secret=APP_SECRET&access_token=SHORT_TOKEN"

The answer includes expires_in, about 5,184,000 seconds, which is 60 days.

Instagram permissions (scopes)

Scope	Lets you
`instagram_business_basic`	Read the profile and media; required to refresh tokens
`instagram_business_content_publish`	Publish posts, reels and carousels
`instagram_business_manage_comments`	Read, reply to, hide and delete comments
`instagram_business_manage_messages`	Send and receive direct messages

The older business_basic style names were deprecated on 27 January 2025. If old code asks for them, the login fails.

Test the token: first request

curl "https://graph.instagram.com/v27.0/me?fields=user_id,username,account_type,followers_count,media_count&access_token=LONG_TOKEN"

The same check in Python, run once a day so you notice problems early:

import os
import requests

TOKEN = os.environ["IG_TOKEN"]
BASE = "https://graph.instagram.com/v27.0"

r = requests.get(f"{BASE}/me", params={
    "fields": "user_id,username,account_type,followers_count,media_count",
    "access_token": TOKEN,
}, timeout=30)
body = r.json()
if "error" in body:
    err = body["error"]
    raise SystemExit(f"{err.get('code')}/{err.get('error_subcode')}: {err.get('message')}")
print(body["username"], body["account_type"], body["followers_count"])

account_type comes back as BUSINESS or MEDIA_CREATOR. The version in the path is the one Meta's get started page uses today; pin one and upgrade on purpose.

How long does an Instagram access token last?

Token	Lifetime	How you get it
Authorization code	1 hour, single use	Redirect after consent
Short-lived token	1 hour	POST to api.instagram.com/oauth/access_token
Long-lived token	60 days, refreshable	`ig_exchange_token`

How to refresh an Instagram long-lived token

curl "https://graph.instagram.com/refresh_access_token?grant_type=ig_refresh_token&access_token=LONG_TOKEN"

Meta's rules: the token must be at least 24 hours old, not yet expired, and the user must have granted instagram_business_basic. A token not refreshed within 60 days expires and cannot be refreshed. The user must log in again.

A worked schedule: you get a long-lived token on 1 March. Refreshing on 2 March is allowed. A weekly cron that refreshes every token older than 7 days keeps each one at least 53 days from expiry, so a missed week or two does no harm. Store the new token and its expires_in each time.

Common Instagram token errors

Code	Meaning	Fix
190	Token expired or invalid. Subcode 463 is expired, 460 password changed, 458 app removed, 467 invalid	Send the user through login again
10 or 200 to 299	Permission missing	Request the scope; Advanced Access needs App Review
4 or 17	App or user throttled	Back off and spread calls out
1 or 2	Temporary error	Retry later
368	Temporarily blocked for a policy issue	Stop and review what the app was doing

Codes are from Meta's Graph API error guide. Rate limits follow a formula: calls in 24 hours = 4,800 times the account's impressions, counted per app and user.

Standard Access, Advanced Access and App Review

A new app has Standard Access, which works for accounts that have a role on your app. To serve accounts you do not manage, you need Advanced Access, which requires App Review and Business Verification. Plan for that review before launch, not after.

If you just need public data

Many people chasing a token only want to read public profiles and posts of accounts they do not own, which this API cannot do with Instagram Login. ScrapeIO reads public data with one key and no Meta app: the Instagram profile API, user posts API, reels API with real play counts, and comments API. Calls cost 1 credit and private or missing accounts are free. More options are in Instagram public data without the Graph API and on the Instagram MCP server page.

curl "https://scrapeio.com/v1/instagram/profile?handle=nike" \
  -H "x-api-key: YOUR_KEY"

FAQ

Can I get an Instagram access token for a personal account?

No. Since the Basic Display API ended on 4 December 2024, Meta's APIs serve professional accounts only. Switching to a free Creator account is enough.

Do Instagram access tokens expire?

Yes. Short-lived tokens last one hour and long-lived tokens 60 days. Refresh long-lived tokens before day 60 to keep them going.

Why does refresh_access_token fail?

Usually the token is under 24 hours old, already expired, or the user did not grant instagram_business_basic.

Can I use an Instagram token to read other accounts?

Not with Instagram Login. Business Discovery and hashtag search need the Facebook Login setup and Advanced Access.

Where is the Instagram access token generator?

In your app dashboard under Instagram, API setup with Instagram login, Generate access tokens. It is meant for testing with accounts that have a role on your app.

Sources

Checked on 9 November 2026 from each vendor's own pages. Prices and limits change; follow the links before you decide.

100 free credits, no card. Credits never expire.

Get API key