Instagram API in 2026: Access, Limits, Cost and Posting

Meta's Instagram Platform overview describes two configurations. They share the same media and comment model but differ in who logs in, which host you call and which permissions exist.

For a product that posts on behalf of creators and small brands, Instagram Login is usually the easier choice: your users do not need a Facebook Page, and the flow is a single Instagram consent screen. Pick Facebook Login when your users already manage Pages, or when you need hashtag search or the insights permission (instagram_manage_insights) that the overview lists for that setup. Messaging works in both, inside a 24-hour window after the user writes, or 7 days with the Human Agent tag.

There is no per-call price. Meta's Instagram Platform documentation has no pricing section and no billing step in app setup; what it limits is volume, through rate limits. That is why searches for "Instagram API pricing" or "Instagram API cost" mostly land on third-party tools, which charge for their own service on top of Meta's free API.

The real cost is time. Before your app can serve accounts you do not own, it needs Advanced Access, which requires App Review and Business Verification. You also pay in maintenance: tokens that expire after 60 days, media that has to sit on a public URL, and publishing failures that only show up as container status codes.

There is no single "Instagram API key". Your app gets an app ID and secret, and each connected account produces its own access token. The path looks like this:

1. Switch the Instagram account you will test with to a professional account (Business or Creator).
2. Create a Business type app in the Meta App Dashboard. Meta's get-started guide says an app of any other type has to be recreated.
3. Add the Instagram product and choose a setup: API setup with Instagram business login, or the Facebook Login setup.
4. Request the permissions your features need, and only those, because each one is reviewed.
5. Build the OAuth flow. Short-lived tokens last one hour, long-lived tokens last 60 days and can be refreshed. For your own account, the Generate token button in the dashboard gives you a 60-day token directly.
6. Test with Standard Access, which is the default and covers people who have a role on your app.
7. Submit for App Review and complete Business Verification to get Advanced Access, so any professional account can authorize your app.

Step 7 is the slow one. Reviewers want a screen recording of each permission in use and a way to test it. Our Meta App Review guide for Instagram covers what they check and the usual reasons for rejection.

According to Meta's content publishing guide, you can publish single images, videos, Reels, carousels and Stories. Every post goes through the same two calls: create a media container with POST /<IG_ID>/media, then publish it with POST /<IG_ID>/media_publish. The example on this page builds a carousel, the format with the most moving parts.

The rules that break real integrations:

• JPEG is the only supported image format. A PNG export fails until you convert it.
• Media you pass by URL must be on a publicly accessible server when Instagram fetches it.
• A carousel holds at most 10 images, videos or a mix of both.
• A container that is not published within 24 hours expires (EXPIRED). Video containers need time to process, so wait for FINISHED before publishing.
• Shopping tags, branded content tags and filters are not supported.
• Trial Reels, shown only to non-followers at first, are created with a trial_params field.

There is no field for a future publish time. If you want scheduled posts, your own system has to store the post and call media_publish at the right moment.

There are two separate limits, and you will meet the second one first:

• Business Use Case rate limit. Most endpoints allow, per app and account pair, "4800 * Number of Impressions" calls in a rolling 24-hour window, where impressions are the number of times the account's content was seen in that period. Hashtag search and Business Discovery use the general Platform Rate Limits instead.
• Publishing limit. The content publishing guide caps accounts at 100 API-published posts in a 24-hour moving period. An older line on the same page still says 50, so read GET /<IG_ID>/content_publishing_limit before a large batch instead of trusting either number.

Messaging has its own ceilings: the Send API allows 100 calls per second for text, links, reactions and stickers and 10 per second for audio or video, and private replies to post and Reel comments are capped at 750 calls per hour. Our social media API rate limits reference puts these numbers next to the other networks.

Each network puts its gate in a different place. TikTok keeps posts from unaudited apps private until a separate audit passes, as our TikTok API guide explains. LinkedIn lets a member post to their own profile through the self-serve Share on LinkedIn product, while Company Page posting needs the Community Management API. Instagram has one gate for everything, App Review plus Business Verification, but it only lets professional accounts in. Once you pass, the same container flow covers every format.

If Instagram is the heart of your product, build directly. The API is free and well documented, and one container flow covers every format. Plan for the parts around it: a token refresh job, a public media host that serves JPEGs, a status poller for containers, a scheduler, and handling for the Instagram Graph API error codes that come back when a container fails.

If Instagram is one destination among several, that layer is what PostGate's Instagram integration takes care of. Accounts connect through hosted OAuth, and one request publishes a feed post, Reel, carousel or Story, now or at a scheduled_at time. The profile health endpoint reports how much of the rolling 24-hour publishing quota is left, and each account gets its own delivery result.