Instagram Access Token: How to Get One in 2026

It depends on the login your app uses. Meta's Instagram Platform overview lists three setups, and each one hands you a different token:

All three only work with Instagram professional accounts, meaning Business or Creator. Personal accounts lost API access when Meta retired the Basic Display API on December 4, 2024, which also explains why so many old tutorials end in errors (more on that in what actually changed with instagram_basic and the Instagram scopes).

For an app that publishes or reads data for professional accounts, Instagram Login is the shortest path: no Facebook Page, one host and one token per account. Meta recommends Unified Login for new integrations, and it lets people log in with either Instagram or Facebook, at the cost of a business portfolio and a different token type. Facebook Login is the one you need for features Instagram Login lacks, such as hashtag search and product tagging. The rest of this guide uses Instagram Login, with a short section on the Facebook Login route.

No. What people search for as an "Instagram API key" is a pair of app credentials plus a token. The app ID and app secret identify your app. The access token identifies the Instagram account and the permissions it granted. You need all three, and only the token is sent on ordinary API calls.

Watch which app ID you copy. Meta's overview says apps using Facebook Login for Business use the Meta app ID shown at the top of the App Dashboard, while apps using Business Login for Instagram use the separate Instagram app ID found under Instagram > API setup with Instagram login. The dashboard shows both, so check that the ID you send to instagram.com/oauth/authorize is the Instagram one.

The app secret never leaves your server. Meta's access token reference says requests that include it should only be made in server-side code, never in client-side code or an app binary that could be decompiled.

If you only need a token for an account you manage, for a script, a test or an internal tool, the App Dashboard can generate one without any OAuth code. From Meta's Instagram Login get-started guide:

1. Create an app in the Meta App Dashboard and choose the Business type. An existing app of another type can't be converted, so you create a new one.
2. In the left menu, open Instagram > API setup with Instagram business login.
3. Click Generate token next to the Instagram account, log in to Instagram and copy the token.
4. Test it with GET https://graph.instagram.com/v26.0/me?fields=user_id,username&access_token=.... A working token returns the account's user_id and username.

Tokens generated in the dashboard are already long-lived, valid for 60 days, so you skip the exchange step. Store the token in a secret manager or an environment variable, not in the repository, and put the refresh call from the section below on a schedule.

On the Facebook Login route, the equivalent shortcut is the Graph API Explorer. Meta's Facebook Login get-started guide requests instagram_basic and pages_show_list, which returns a Facebook User access token. You then call GET /me/accounts to find the Page linked to the Instagram account and GET /{page-id}?fields=instagram_business_account to get the Instagram account ID used in later calls.

To get tokens for accounts that belong to other people, you run Business Login for Instagram, Meta's OAuth 2.0 authorization code flow. The Business Login documentation describes three requests:

1. Authorize. Redirect the user to https://www.instagram.com/oauth/authorize with client_id (the Instagram app ID), redirect_uri, response_type=code and scope. The current scope values are instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_messages. Add a state value and check it on the way back.
2. Exchange the code. Instagram redirects to your URI with a code that is valid for one hour and works once. The redirect can end with #_, which is not part of the code, so strip it. Then POST the code with your app ID, app secret and the same redirect URI to https://api.instagram.com/oauth/access_token. The response wraps a short-lived token, the Instagram user ID and the granted permissions in a data array.
3. Go long-lived. A short-lived token expires in one hour. Exchange it right away at https://graph.instagram.com/access_token with grant_type=ig_exchange_token to get one valid for 60 days.

# 1. Send the user to Instagram (scopes are comma-separated)
https://www.instagram.com/oauth/authorize
  ?client_id=INSTAGRAM_APP_ID
  &redirect_uri=https://app.example.com/instagram/callback
  &response_type=code
  &scope=instagram_business_basic,instagram_business_content_publish
  &state=RANDOM_STATE

# 2. Instagram redirects back with ?code=...#_  (strip the trailing #_)
#    Swap the code for a short-lived token within one hour, server side
curl -X POST https://api.instagram.com/oauth/access_token \
  -F client_id=INSTAGRAM_APP_ID \
  -F client_secret=INSTAGRAM_APP_SECRET \
  -F grant_type=authorization_code \
  -F redirect_uri=https://app.example.com/instagram/callback \
  -F code=CODE_FROM_REDIRECT
# -> { "data": [ { "access_token": "...", "user_id": "...", "permissions": "instagram_business_basic,..." } ] }

# 3. Exchange it for a long-lived token (60 days), still server side
curl "https://graph.instagram.com/access_token?grant_type=ig_exchange_token&client_secret=INSTAGRAM_APP_SECRET&access_token=SHORT_LIVED_TOKEN"
# -> { "access_token": "...", "token_type": "bearer", "expires_in": 5183944 }

# 4. Check it works
curl "https://graph.instagram.com/v26.0/me?fields=user_id,username&access_token=LONG_LIVED_TOKEN"

Read the permissions string in the response before you save anything. It lists what the user actually granted, and that is all the token can do. If your app publishes and instagram_business_content_publish is missing, treat it as a failed connection and ask the user to reconnect.

Running this flow means a callback route, a token table with encryption and a refresh job for every connected account. That is the part PostGate takes off your plate: its hosted OAuth connection flow runs the redirect and the callback, stores and refreshes the token, and gives your product a profile ID to post with, so the access token never reaches your database.

A short-lived Instagram User token lasts one hour. A long-lived one lasts 60 days. You can refresh a long-lived token with one call, as long as the token is at least 24 hours old, has not expired and the user granted instagram_business_basic:

curl "https://graph.instagram.com/refresh_access_token?grant_type=ig_refresh_token&access_token=LONG_LIVED_TOKEN"

The refreshed token is valid for another 60 days. A token that goes 60 days without a refresh expires and can't be refreshed anymore, so the only fix is sending the user through the login again. A weekly job that refreshes every token older than a day is enough to never hit that wall. Our post on the 60-day cycle of Instagram long-lived tokens covers what can kill a token before the 60 days are up, such as a password change or revoked access.

These are the failures the Business Login documentation names, plus the access problem that catches most new apps:

• error=access_denied&error_reason=user_denied on your redirect URI: the user clicked cancel. Meta says failing gracefully here is your job, so show a way to try again instead of an error page.
• "Matching code was not found or was already used" (OAuthException, code 400) on the code exchange: the code was used twice, is older than an hour, still has the #_ suffix, or the redirect_uri doesn't match the one used in the authorize step exactly.
• Invalid scopes on the login screen: usually the old unprefixed names such as business_basic, which Meta deprecated on January 27, 2025, or Facebook Login permissions sent to the Instagram Login endpoint.
• Login works for you but not for customers: Standard Access only covers accounts you own or manage and have added to the app. Serving anyone else takes Advanced Access, which means App Review and Business Verification, as laid out in the Meta Advanced Access requirements.

Once you have a token, an expired or revoked one shows up on API calls as error 190. The guide to Instagram API error 190 explains its subcodes and why retrying never fixes it.

• The app is a Business type app and the OAuth request uses the Instagram app ID, not the Meta app ID.
• The redirect URI is registered in the dashboard and matches the token request character for character.
• The state parameter is generated per login and verified on the callback.
• The code exchange and the long-lived exchange run on the server, and the app secret is never shipped to a browser or a mobile build.
• The granted permissions are checked against what your feature needs before the connection is saved.
• Tokens are encrypted at rest and stored per account with the time they were issued.
• A scheduled job refreshes tokens older than 24 hours well before day 60, and failed refreshes mark the account for reconnection.
• Advanced Access is approved for every permission you request if customers outside your business will connect.