Guides / Developers

Get an Instagram Graph API Access Token

To read Instagram data with the Graph API, you need an access token and the id of the Instagram account. This guide shows how to get both with Facebook Login, test them, and change a short-lived token into a long-lived one.

Updated November 7, 2026

What you need

  1. An Instagram professional account, Business or Creator. A personal account cannot use the Graph API. You can switch an account to professional in the Instagram app settings.
  2. A Facebook Page that is linked to the Instagram account. This guide uses the Instagram API with Facebook Login, which reaches the Instagram account through its Page.
  3. A Meta developer account. Register at Meta for Developers with your Facebook account.

Meta also has a second option, the Instagram API with Instagram Login, which does not need a Facebook Page. It uses different permissions and endpoints, so the steps below do not apply to it.

Step 1: create a Meta app

  1. On Meta for Developers, open My Apps and create a new app.
  2. Select the use case for Instagram with Facebook Login, or a Business app type.
  3. Add the Instagram product and Facebook Login to the app.

Meta changes the names of these menus from time to time. If a name does not match, follow the current steps in the Instagram Platform documentation.

While the app is in development mode, it works for the people who have a role on the app. That is enough to read your own accounts. To read the accounts of other people, Meta must review the app first.

Step 2: get a user access token

The quickest way to get a token for a test is the Graph API Explorer:

  1. Select your app.
  2. Select Get User Access Token.
  3. Add these permissions: instagram_basic, instagram_manage_insights, pages_show_list and pages_read_engagement.
  4. Generate the token, and allow access to the Page and the Instagram account when Facebook asks.

If a business portfolio owns the Page, Meta can also ask for business_management. To publish content, you need more permissions, such as instagram_content_publish.

Step 3: find the Instagram account id

Ask for your Pages and the Instagram account that is linked to each Page:

curl "https://graph.facebook.com/v25.0/me/accounts?fields=name,instagram_business_account&access_token=$TOKEN"

The instagram_business_account.id of the Page is the Instagram account id. A Page with no linked Instagram account does not have this field.

Test the token and the id with one call:

curl "https://graph.facebook.com/v25.0/$IG_USER_ID?fields=username,followers_count&access_token=$TOKEN"

Step 4: get a long-lived token

A token from the Graph API Explorer is short-lived. It expires after about one hour. Change it into a long-lived token that lasts about 60 days:

curl "https://graph.facebook.com/v25.0/oauth/access_token?grant_type=fb_exchange_token&client_id=$APP_ID&client_secret=$APP_SECRET&fb_exchange_token=$SHORT_TOKEN"

The answer has the new access_token. The app secret is on the app settings page. Run this call only on a server, because it uses the app secret.

If you call /me/accounts with the long-lived user token, each Page in the answer also has its own access_token. A Page token from a long-lived user token usually has no expiry date. It stops working if the user changes the password, removes the app, or loses access to the Page.

Use the token

Keep the token and the app secret on your server, in environment variables. Do not put them in a browser, a mobile app or a file that you commit.

The free @storylinkpro/instagram-stories-api client reads both variables. This command prints the account with no install:

export INSTAGRAM_ACCESS_TOKEN=…
export INSTAGRAM_USER_ID=…
npx @storylinkpro/instagram-stories-api account

To read story views, reach and replies next, read Get Instagram Story insights with the Graph API.

When the token stops working

  • Error code 190. The token expired, someone revoked it, or it is not valid. Get a new token.
  • Error code 10 or 200. The token does not have a permission that the call needs. Get a new token with that permission.
  • Error code 4, 17 or 32. Meta limits how many calls the app or the account can make. Wait before you call again.