Instagram API key: what you actually need instead
There is no Instagram API key. Meta issues an app ID and an app secret, and every call is authorised by an access token tied to one professional account, obtained through OAuth and valid for 60 days. The search term is wrong, not your understanding. Everything below was read on Meta's developer documentation on November 13, 2026.
Why the thing you are looking for does not exist
The confusion is reasonable, because other platforms do work that way. A YouTube API key is a string you paste into a URL to read public data. Pinterest, Google Maps and most read-only APIs hand you something similar.
Instagram never does. There is no endpoint that returns public Instagram data in exchange for a project-level string. Every Instagram endpoint acts on behalf of a specific account that has granted your app permission, which means a user token, not a key.
| API key model | ||
|---|---|---|
| What identifies you | a project string | an app ID plus a user access token |
| Who consents | nobody | the account owner, through an OAuth screen |
| Reads public data | yes | no such endpoint |
| Expires | no | 60 days, refreshable |
| Account type needed | none | Instagram professional, business or creator |
So the rest of this page is about the three objects that replace the key: an app, a professional account and a token.
What you need before anything works
A professional account. Business or creator. A personal Instagram profile cannot be reached by the API at all, in any configuration. Switching is free and takes a minute in the Instagram app, and it is the single most common reason a correct integration returns nothing.
A Meta app. Created in the Meta App Dashboard, with the Instagram product added. This is where the two credentials people call a key actually live: the Instagram App ID, which goes on requests as client_id, and the Instagram App Secret. Both sit under App Dashboard, Instagram, API setup with Instagram login, then Business login settings.
The right scopes. Four values, and the old business_* names are deprecated:
instagram_business_basic, required for everything, including refresh.instagram_business_content_publishto publish.instagram_business_manage_commentsto read and reply to comments.instagram_business_manage_messagesfor the DM inbox.
How to get an Instagram API access token
Four calls. The Business Login for Instagram documentation is the source for each one.
1. Send the user to the authorisation window.
https://www.instagram.com/oauth/authorize
?client_id=INSTAGRAM_APP_ID
&redirect_uri=https://yourapp.com/auth
&response_type=code
&scope=instagram_business_basic,instagram_business_content_publish
&state=anti_csrf_value
The redirect_uri has to match one registered in the dashboard exactly. If the user approves, they come back with a code.
2. Trade the code for a short-lived token. The code is valid for one hour and can be used once. It arrives with a trailing #_ that you strip before sending it.
curl -X POST https://api.instagram.com/oauth/access_token \
-F client_id=INSTAGRAM_APP_ID \
-F client_secret=INSTAGRAM_APP_SECRET \
-F grant_type=authorization_code \
-F redirect_uri=https://yourapp.com/auth \
-F code=AQBx...
You get back an access_token, the Instagram-scoped user_id and the granted permissions. That token lasts one hour, which is long enough to do step 3 and nothing else.
3. Exchange it for a long-lived token. Server side only, because it carries your app secret.
curl -G https://graph.instagram.com/access_token \
-d grant_type=ig_exchange_token \
-d client_secret=INSTAGRAM_APP_SECRET \
-d access_token=SHORT_LIVED_TOKEN
The response carries expires_in: 5183944, which is 60 days.
4. Refresh it before day 60.
curl -G https://graph.instagram.com/refresh_access_token \
-d grant_type=ig_refresh_token \
-d access_token=LONG_LIVED_TOKEN
Three conditions, all of them documented and all of them easy to fail: the token must be at least 24 hours old, it must not have expired yet, and the user must have granted instagram_business_basic. Miss the window and there is no recovery path. An expired long-lived token cannot be refreshed, and the user has to go through the authorisation screen again.
Instagram Login or Facebook Login: pick the configuration first
Meta ships two ways to connect, and they are not interchangeable. Choosing the wrong one means redoing the OAuth work.
| Instagram API with Instagram Login | Instagram API with Facebook Login | |
|---|---|---|
| Facebook Page required | no | yes, linked to the account |
| User logs in with | Instagram credentials | Facebook credentials, with Page admin rights |
| Content publishing | yes | yes |
| Comment moderation | yes | yes |
| Insights | yes | yes |
| Mentions | yes | yes |
| Messaging | yes, natively | through the Messenger Platform |
| Hashtag search | no | yes |
| Product tagging | no | yes |
| Partnership ads | no | yes |
For a creator tool, Instagram Login is the lighter path: no Page, no Page admin check, and messaging without the Messenger Platform on top. Take Facebook Login when you need hashtag search, product tagging or partnership ads, none of which exist on the other side. Token lifetimes are identical either way: one-hour codes, one-hour short-lived tokens, 60-day long-lived tokens.
What neither gives you is the old read-only path. The Basic Display API is gone, and the replacement for that use case is covered in the Instagram Basic Display API alternative. The endpoint-by-endpoint picture of what is left is in the Instagram Graph API in 2026.
The part that breaks three months later
Getting a token is an afternoon. Keeping tokens alive is the actual job, and it is where small integrations rot.
The 60-day clock runs per account. With one account you can refresh it by hand and remember. With twelve, you need a scheduled job that refreshes each token well before expiry, stores the new one, and tells you when a refresh fails, because a failure is silent: the old token keeps working until the day it does not.
Three more ways the same system bites, none of them about your code:
- A user changes their Instagram password or revokes the app, and the token dies immediately regardless of its expiry date.
- An account switches back to personal, and every call starts failing with a permissions error rather than an account-type error.
- Your app stays in development mode, where it only works for people with a role on it. Going past that means Meta's app review for each permission you use.
The same pattern plays out on every network with a different clock and a different silent failure, which is what social media access tokens is about.
When to stop building this yourself
If Instagram is the only network you touch, do it yourself. One app, one OAuth flow, one refresh job is a known quantity, and you keep full control of the scopes.
The arithmetic changes with the second network. Each one adds its own app, its own review, its own token lifetime and its own reason to disconnect overnight. That is what PlugKit does instead: Instagram, Facebook, LinkedIn, TikTok, YouTube, X, WhatsApp and Telegram behind one REST API and one hosted MCP server at https://api.plugkit.co/mcp, with the OAuth, the refresh and the reconnection handled. It is $49 a month for 5 connected accounts, cancel anytime, or $97 for 30. Seven days free, a card at sign-up and nothing charged before day 7.
It does not remove Meta's app review, and nothing can when you publish under your own app. What it removes is the per-platform credential work and the refresh jobs. The comparison across providers is in the social media API guide, and if an agent rather than a script is doing the posting, the Instagram MCP server is the shorter path.
FAQ
Does Instagram have an API key?
No. Meta issues an Instagram App ID and an Instagram App Secret for your app, and every request is authorised by a user access token obtained through OAuth. There is no project-level key that reads public Instagram data, because no such endpoint exists.
How do I get an Instagram API access token?
Send the account owner to https://www.instagram.com/oauth/authorize, exchange the returned code at https://api.instagram.com/oauth/access_token for a one-hour token, then exchange that at https://graph.instagram.com/access_token with grant_type=ig_exchange_token for a 60-day token. The account must be a professional one.
How long does an Instagram access token last?
Authorisation codes and short-lived tokens last one hour. Long-lived tokens last 60 days and can be refreshed once they are at least 24 hours old. A long-lived token that expires cannot be refreshed, so the user has to authorise again.
Can I use the Instagram API with a personal account?
No. The API only reaches professional accounts, business or creator. Switching an account to professional is free and takes a minute in the Instagram app, and it has to be done before the OAuth flow, not after.
Do I need a Facebook Page for the Instagram API?
Only with the Facebook Login configuration. Instagram API with Instagram Login works without a Page and covers publishing, comments, insights, mentions and messaging. You need the Page-linked path for hashtag search, product tagging and partnership ads.
One plug for every platform your agent touches
$49 a month for 5 connected accounts, cancel anytime. Every feature in every plan.
Get your API key →