Invalid Scopes: is instagram_basic actually deprecated? (No — here’s what really changed)

There genuinely was a full shutdown: the old Instagram Basic Display API — a separate product with its own OAuth flow for read-only access to personal Instagram accounts, using permissions like user_profile and user_media — was retired completely on December 4, 2024, as widely reported at the time (see TechCrunch's coverage). That API is gone, not deprecated-but-working, and it had nothing to do with a permission called instagram_basic.

instagram_basic is a different permission entirely, and — per Meta's current Instagram Platform overview— it is not deprecated. Meta documents two parallel, both currently supported configurations for accessing business/creator Instagram accounts: "Instagram API with Instagram Login," which uses permissions prefixed instagram_business_, and "Instagram API with Facebook Login for Business," which uses instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights, and instagram_manage_messages — the Page-linked flow. Neither list is marked as replacing the other; they are two different integration models a developer chooses between, not an old-vs-new pair.

What Meta's own Instagram Platform changelog does document as deprecated is narrower than most troubleshooting guides suggest: the original, unprefixed scope names used early in the Instagram Login product — business_basic, business_content_publish, business_manage_comments, and business_manage_messages — were renamed to their instagram_business_-prefixed equivalents, with the old unprefixed names deprecated on January 27, 2025. If your "invalid scope" error traces back to a real deprecation rather than a copy-paste mix-up, this is almost certainly it.

Work through these in order rather than assuming which one applies:

• Are you still calling the old Basic Display API (its own OAuth host, and permissions named user_profile/user_media) for a personal Instagram account? There is no like-for-like replacement — that surface is gone. You have to convert the account to a Business or Creator account and integrate against the Instagram Graph API instead.
• Are you using the pre-January-2025 unprefixed scope names from the Instagram Login product? Replace them one-to-one:
  • business_basic → instagram_business_basic
  • business_content_publish → instagram_business_content_publish
  • business_manage_comments → instagram_business_manage_comments
  • business_manage_messages → instagram_business_manage_messages
• Are you mixing permissions from the two current configurations in a single OAuth request — for example requesting instagram_basic (Facebook Login for Business) alongside instagram_business_content_publish (Instagram Login)? Meta's docs do not spell out in prose that this is rejected, but developers commonly report exactly this combination producing scope errors. Pick one configuration for a given connection flow and request only its permissions.

If none of those match, you are very likely dealing with instagram_basic and its siblings working as intended under the Facebook Login for Business configuration — in which case the fix is not a permission rename at all, but making sure the rest of your flow (Page linkage, account type, token type) matches what that configuration expects.

This only applies if you were on the Instagram Login product with the old unprefixed scope names — skip it if you are staying on Facebook Login for Business with instagram_basic. Meta's reviewers evaluate your screencast and use-case justification against the specific permission you are requesting, so a submission that still talks about your integration in business_basic-era language will read as stale even after you fix the scope string in code. Update your review notes and demo flow to match the current instagram_business_ permission names.

If your app was previously approved under the old unprefixed scope names, that approval does not automatically carry over. Expect to resubmit for the renamed scopes and to walk through review again.

Beyond an outright OAuth scope error, watch for:

• A successful-looking login that returns a token missing the permission you expected, which then fails later with an OAuthException (commonly code 10 or code 200, Meta's permission-error family) the first time you call an endpoint that needed it.
• Integrations that worked for existing connected accounts but fail for every new connection attempt — a strong signal that the scope itself, not the account, changed underneath you.
• Old SDK versions or copy-pasted OAuth URLs that still hardcode the genuinely deprecated names. Grep your codebase for the unprefixed business_basic, business_content_publish,business_manage_comments, and business_manage_messages — those are the ones Meta actually retired. If instead you find instagram_basic and its siblings sitting next to instagram_business_-prefixed scopes in the same request, that mismatch between the two connection models is a more likely culprit than either name being dead.

PostGate's hosted connection flow requests the current instagram_business_ permission set on your behalf, so your integration never has to track Meta's permission renames directly — see Profiles & connections for how the hosted OAuth flow is scoped. If you connect Instagram through your own Meta app instead, PostGate's connection response and structured error envelope still surface a permission mismatch as a distinct, actionable error rather than a silent downstream failure.