Instagram API error 190: invalid or expired token

Code 190 is an OAuthException indicating the access token failed validation — it is expired, was revoked, or is otherwise invalid. Meta's Graph API error-handling guide documents this as a token-level failure distinct from a permission error (codes 10/200) or a rate-limit error (codes 4/17/32) — the token itself, not what it is allowed to do or how often it has been used, is the problem. See Instagram Graph API error codes: the complete index for how this fits alongside the other codes you will encounter in a publishing integration.

Code 190 almost always arrives with a subcode, and the subcode is the part worth logging and acting on:

• Subcode 460 — the account's password or a security-relevant setting changed since the token was issued. Meta invalidates existing tokens as a security measure when this happens; it is not something your integration did wrong.
• Subcode 463 — the login status or access token has expired, been revoked, or is otherwise invalid. This is the broadest of the three and the one you will see most often on a long-lived token that simply ran out its clock.
• Subcode 467 — the access token is invalid, often because it was issued for a different app, has already been explicitly revoked by the user, or the underlying authorization was removed from the account's connected-apps settings.

Without a subcode, treat a bare code 190 the same as subcode 463 — expired or invalid, requiring reconnection — since that is the behavior Meta's general OAuth error guidance describes for an unqualified OAuthException.

A code 190 is not a transient failure. The token is not going to spontaneously become valid again on the next attempt, and repeated retries against the same expired credential do nothing except burn your app's rate-limit budget on calls that will fail identically every time. This is the clearest example of an error that needs to be classified as non-retryable in your integration rather than fed into a generic exponential-backoff retry loop, with reconnection as the only path back to a working connection.

The only real fix is having the account owner reconnect — send them back through the OAuth flow so Instagram issues a fresh token. Nothing your backend can do on its own recovers a genuinely expired or revoked token.

You cannot eliminate code 190 — accounts change passwords, users revoke access, tokens run their natural course — but you can reduce how often it surprises a customer:

• Instagram long-lived tokens are valid for 60 days and refreshable before they expire — refresh proactively on a schedule rather than waiting for a publish call to fail.
• Surface a reconnect prompt to the customer the moment you see a code 190, rather than after a scheduled post has already silently failed — the gap between "token died" and "customer finds out" is where support tickets come from.
• Log the subcode, not just the code, in whatever monitoring you use — it is genuinely useful for telling a routine expiry (463) apart from a user-initiated revocation (467) when a customer asks why their connection dropped.

PostGate handles Instagram's 60-day refresh cycle automatically wherever possible, so most accounts never reach a hard code 190 in the first place. When a token genuinely cannot be refreshed, the connected profile moves to an awaiting_reconnect state in PostGate's delivery lifecycle instead of failing posts silently, and the structured error envelope carries the specific cause through so your product can prompt the right customer at the right moment.