You need an app ID and app secret to identify your app, plus an access token for the Instagram account. Only the token goes on ordinary API calls.
Instagram Login gives an Instagram User token on graph.instagram.com. Facebook Login and Unified Login give Facebook-side tokens on graph.facebook.com.
All three work with Business or Creator accounts. Personal accounts lost API access when Meta retired the Basic Display API on December 4, 2024.
In the Meta App Dashboard, Instagram > API setup with Instagram business login can generate a token for an account you manage. It is already valid for 60 days.
1. Send the user to instagram.com/oauth/authorize
2. Swap the code at api.instagram.com within one hour
3. Exchange for a long-lived token at graph.instagram.com
A short-lived token lasts one hour. A long-lived one lasts 60 days and can be refreshed once it is at least 24 hours old.
A token that goes 60 days without a refresh expires for good and the user has to log in again. A weekly refresh job avoids that.
The guide has the complete OAuth code, the refresh call, the Facebook Login route and the errors you hit when requesting a token.
postgate.studio