Instagram long-lived access token: the 60-day cycle
How Instagram's 60-day long-lived access token works, when it can be refreshed, and what happens if it expires before you do.
By André LugAn Instagram long-lived access token lasts about 60 days, per Meta's documentation. You get it by exchanging the short-lived User token issued at authorization, which lasts only hours. Refreshing before expiry extends the clock 60 days from the refresh, and a Page token derived from it carries no fixed expiry — but a password change, revoked access, or lost admin role invalidates it immediately.
Instagram publishing runs on Meta's access token model, and that model starts short-lived. A token issued at the moment a customer authorizes your app lasts only hours on its own — everything that keeps a connection alive for months afterward depends on exchanging it for a long-lived token and handling the cycle that follows correctly.
PostGate handles OAuth, publishing and delivery evidence for every network through one API. Start free or read the docs.
Short-lived, then long-lived: the exchange that matters
A short-lived User token from Facebook Login — the token type behind an Instagram Business connection, since Instagram publishing is authorized through the linked Facebook Page — is first exchanged for a long-lived User token, which Meta documents as lasting about 60 days. That exchange is the step every Instagram integration depends on: skip it, or let it silently fail, and the connection is built on a token that was never going to survive the day.
We verified this exact 60-day figure, and the mechanics of the exchange, while documenting PostGate's Facebook Page access token flow — the same underlying Meta token exchange Instagram Business publishing rides on.
What does the 60-day window actually cover?
The 60-day clock runs on the long-lived User token. Two different things can follow from it, and the distinction matters for how you monitor a connection:
- A Page access token derived from that long-lived User token — obtained by calling
GET /me/accounts— is documented by Meta as not carrying a fixed expiration of its own. It lasts until something invalidates it (a password change, a revoked app, a lost admin role), rather than until a clock runs out. - A long-lived token obtained directly for Instagram publishing carries the 60-day expiry itself, and needs to be refreshed before that window closes to keep working — refreshing extends the clock for another 60 days from the refresh, not from the original grant.
Either way, the practical takeaway is the same: "long-lived" does not mean permanent, and a connection that looks stable today can still depend on a refresh happening on schedule, or on a token that was never re-validated after the underlying account changed.
What can end the cycle before 60 days is up?
Not carrying a fixed expiry date is not the same as being permanent. A token in this family stops working the moment the admin who granted it changes their Facebook password, revokes the app's access from their own account settings, loses their admin role on the linked Page, or the app itself is deauthorized — any of which invalidates the token immediately, independent of the 60-day figure entirely. When that happens, the fix is reconnection, not a refresh: there is nothing left to refresh.
What if it expires before you're watching?
A token that runs past its window without being refreshed or replaced fails the same way any expired credential does: the next publish attempt against it is rejected, and the connection needs to be re-authorized from scratch — the customer has to go through the connection flow again, not just wait for a background refresh to catch up. This is exactly the gap that turns a routine 60-day cycle into a support ticket: the expiry is predictable, but only if something is actually tracking it.
How does PostGate handle the cycle?
You never perform the exchange or track the 60-day clock yourself. POST /api/profiles/connect generates a hosted URL; the customer authorizes on Meta's own domain; PostGate performs the long-lived exchange and stores the resulting token server-side, refreshing it ahead of expiry rather than waiting for a publish call to fail. The profile health endpoint exposes token_expires_at and reconnect_required so your product can see where a connection sits in its cycle at any time, and the profile.expiring webhook gives a heads-up window before anything actually breaks — with profile.expired (reason: "token_expired") and profile.reauth_required reserved for the cases that genuinely need the customer back in the loop.
curl -X POST https://postgate.studio/api/profiles/connect \
-H "Authorization: Bearer $POSTGATE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"platform": "instagram",
"profile_group_id": "grp_acme123",
"return_url": "https://app.example.com/settings/social"
}'Frequently asked questions
How long does a short-lived Instagram access token last?
Only hours. The token issued at the moment a customer authorizes your app is short-lived, and everything that keeps an Instagram connection alive for months depends on exchanging it for a long-lived User token, which Meta documents as lasting about 60 days. Skip that exchange, or let it silently fail, and the connection is built on a token that was never going to survive the day.
Does a Facebook Page access token expire?
A Page access token derived from a long-lived User token — obtained by calling GET /me/accounts — is documented by Meta as not carrying a fixed expiration of its own. It lasts until something invalidates it: the granting admin changes their Facebook password, revokes the app's access, loses their admin role on the linked Page, or the app is deauthorized.
What happens if my Instagram token expires before I refresh it?
The next publish attempt against it is rejected, and the connection must be re-authorized from scratch — the customer has to go through the connection flow again, not just wait for a background refresh to catch up. The same applies to a token invalidated early: the fix is reconnection, not a refresh, because there is nothing left to refresh.
Does refreshing a long-lived Instagram token reset the 60 days?
Yes. Refreshing a long-lived token before its window closes extends the clock for another 60 days from the moment of the refresh, not from the original grant. That means a connection stays alive indefinitely as long as something is actually tracking the expiry and refreshing on schedule ahead of it.
