Which Instagram Scrapers Still Work in 2026 (+ Real Costs)

TL;DR — as of April 2026

• The Instagram Basic Display API is dead (shut down December 4, 2024).
• The Instagram Graph API works for Business/Creator accounts only: 200 calls/hour/user, Meta app review required.
• Scraping public, logged-out Instagram data was ruled not a CFAA violation in Meta v. Bright Data (N.D. Cal. Jan. 2024) — consistent with the Ninth Circuit's hiQ Labs v. LinkedIn ruling.
• SocialCrawl is the compliant, unified alternative: one schema across 43 platforms, computed fields for AI agents, managed rate limits.
• Decision tree below: pick your path in under two minutes.

This article is a technical overview, not legal advice. Laws and platform terms vary by jurisdiction — consult qualified counsel before building on public data.

The Instagram API landscape in April 2026 looks nothing like 2023. Instagram reached 3 billion monthly active users in September 2025 (Reuters), making it the second-largest social network on earth after Facebook's 3.07B MAU, and the gap between what Meta's docs describe and what actually works has never been wider.

What does 1,000 Instagram posts cost? On a unified API like SocialCrawl, one Instagram request is 1 credit and returns a page of roughly a dozen posts, so pulling 1,000 posts is about 80 to 90 credits, or £0.17 to £0.50 depending on your credit pack. It is a flat per-request rate with no per-record surcharge, which is the number the rest of this guide compares every other option against.

---

What changed in 2024-2026?

The Basic Display API shut down on December 4, 2024. Meta announced the deprecation on September 4, 2024, killing embed widgets, personal-account OAuth flows, and social-login integrations with no migration path. Meta's own developer navigation still lists Basic Display — which is how stale tutorials keep citing dead endpoints 16 months later.

January 27, 2025: the scope rename. Meta deprecated the old scope names (business_basic, business_content_publish, etc.) and replaced them with instagram_business_-prefixed values on the Instagram API with Instagram Login reference. Apps that didn't update got silent 403s for two weeks before Meta rolled back the enforcement grace period.

Cambridge Analytica is still shaping API policy. Meta removed more than 400 apps from the platform during the 2018 app investigation, and every scope-tightening since — including the 2024-2025 Instagram changes — traces back to that audit. The Graph API v22 (March 2026) tightened instagram_graph_user_profile again, narrowing fields returned on unowned Business accounts.

Four new scraping defenses landed in 2024-2025. Datacenter IPs are blocked on first request, Python's requests and httpx libraries are blocked by TLS fingerprinting, the internal GraphQL doc_id parameter rotates every 2-4 weeks, and behavioral ML flags unnatural request timing. Plain BeautifulSoup scripts no longer work — period.

---

Does the official Instagram API still work in 2026?

Yes, with reduced scope — the Graph API works, but only for Business and Creator accounts, and only through two official paths that both require Meta app review.

Instagram API with Instagram Login is the designated replacement for Basic Display. No linked Facebook Page is required. It covers comment moderation, publishing, insights, and messaging for accounts that have authorized your app via OAuth.

Instagram API with Facebook Login requires a linked Facebook Page but unlocks hashtag search and basic business discovery metadata (follower count, bio, media count) for other Business/Creator accounts without their OAuth approval — the only official endpoint that supports competitor monitoring.

Both paths require Meta app review and share a rate limit of 200 calls per hour per user access token, as documented in Meta's Platform Rate Limits reference. The limit is per user, not per app — an app with 500 connected Business accounts can aggregate to 100,000 calls/hour. What the Instagram Graph API will never give you: full follower lists, historical post insights on competitor accounts, or any data from personal accounts. (For the follower-list workarounds that do exist, see the IG follower export tools guide.)

# Graph API: fetch your own media
curl -X GET \
  "https://graph.instagram.com/v22.0/{ig-user-id}/media?fields=id,caption,media_type,timestamp,like_count,comments_count&access_token={user-access-token}"

For an instagram api key, register a Meta App at developers.facebook.com and generate a long-lived user token. Expect 429 on rate limits, 401 on expired tokens, 400 on stale scope names.

---

Which Instagram scrapers still work in 2026?

Four scrapers still work reliably on public data — Instaloader, Apify, Bright Data, and SocialCrawl — and every one of them hits Instagram's internal REST (i.instagram.com/api/v1/users/web_profile_info) or GraphQL endpoints rather than the official Graph API. The GraphQL path needs a doc_id that rotates every 2-4 weeks. Residential proxies plus TLS fingerprint spoofing via curl_cffi impersonating Chrome are mandatory for any self-hosted approach.

Instaloader is the most maintained open-source Instagram scraper on GitHub: 12,100 stars, v4.15.1, last commit April 11, 2026. Fine for research, painful for production. Any Python Instagram scraper written from scratch should start from curl_cffi, never requests. The broader DIY-vs-API decision is covered in our Python social media crawling guide.

Apify Instagram Scraper (apify/instagram-scraper) is the managed cloud option at ~$1.50 per 1,000 results. Dedicated actors cover apify/instagram-reel-scraper, apify/instagram-comment-scraper, and apify/instagram-hashtag-scraper. Catch: raw data, no computed fields, platform-specific shapes.

Bright Data matters because of the court case. In Meta Platforms, Inc. v. Bright Data Ltd., No. 3:23-cv-00077 (N.D. Cal. Jan. 23, 2024), Judge Edward M. Chen granted summary judgment for Bright Data on Meta's contract claims for data collected while logged out:

"Meta has no protectable interest in public data that it does not own... Scraping of public website data is not actionable under the CFAA where the scraper does not bypass a technological access barrier." — Judge Edward M. Chen, Meta Platforms, Inc. v. Bright Data Ltd. (N.D. Cal. Jan. 23, 2024) (opinion PDF)

The ruling is consistent with the Ninth Circuit's precedent in hiQ Labs v. LinkedIn, where the court held:

"It is likely that when a computer network generally permits public access to its data, a user's accessing that publicly available data will not constitute access without authorization under the CFAA." — hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) (Justia opinion)

Both cases are US federal decisions. They do not speak to GDPR, the UK Data Protection Act, or any non-US regime — and neither shields anyone who logs in, bypasses a technological barrier, or scrapes private data. Tech-law scholar Eric Goldman's analysis of the Bright Data ruling is the most-cited commentary and worth reading before you build.

SocialCrawl wraps working scrapers in a unified REST API. The Graph API returns timestamp, Apify returns taken_at_timestamp, Instaloader returns date_utc — three different field names for the same value. SocialCrawl normalizes them to one schema and adds computed fields (engagement_rate, estimated_reach, content_category, language) so AI agents reason directly from the payload with zero ETL. See your data before writing a single line of integration code in the Instagram endpoint docs.

# SocialCrawl: one schema, all 43 platforms
curl -X GET \
  "https://www.socialcrawl.dev/v1/instagram/profile?username=username_here" \
  -H "x-api-key: YOUR_SOCIALCRAWL_KEY"

Instagram profile scraper, instagram hashtag scraper, instagram comment scraper, ig lead scraper, and instagram reels scraper use cases all collapse to the same three choices: Instaloader + proxies, Apify per result, or SocialCrawl's Instagram data API. If you need to pipe this data into an autonomous workflow, see how to build an AI agent for social media monitoring.

---

Which approach should you pick?

Your choice collapses to one question: do you own the account? Owners use the Graph API, everyone else uses a scraper, and anyone who needs more than one platform uses SocialCrawl.

Prose version: Own a Business/Creator account? Use the Instagram Graph API. Personal account? Convert to Creator in five minutes, then use the Graph API. Don't own the account? Under 1K req/day, Instaloader; 1K-50K req/day, Apify or SocialCrawl; AI pipelines or multi-platform analytics, SocialCrawl. Any Instagram analytics stack for competitor work combines Graph API data (your own accounts) with scraper data — the hybrid approach is the only way to get Instagram analytics for accounts you don't control. To turn that into a working pipeline, the competitor analysis tool build guide walks through it end to end. For a broader look at how all major platforms compare, see our ultimate guide to social media APIs in 2026.

Approach	Works in 2026?	Account types	Rate limit	App review?	Cost
Graph API (Instagram Login)	Yes	Business, Creator	200 req/hr per token	Yes	Free
Graph API (Facebook Login)	Yes	Business, Creator + FB Page	200 req/hr per token	Yes	Free
Instaloader	Yes (with caveats)	Public + private (login)	~200 req/hr per IP	No	Free
Apify Instagram Scraper	Yes	Public	Managed	No	~$1.50/1K results
SocialCrawl	Yes	Public, unified schema + computed fields	Managed	No	Credit-based, free tier
Basic Display API	NO — DEAD	—	—	—	Dead since December 4, 2024

---

Frequently Asked Questions

Can you use the Instagram API for personal accounts?

No — there is no official API for personal accounts in 2026. The Instagram Basic Display API, which was the only path for personal accounts, shut down on December 4, 2024. The only official alternative is converting the account to Creator (free, takes five minutes) and using the Graph API.

How do you get an Instagram API key?

Register a Meta App at developers.facebook.com and generate a long-lived user access token via the Instagram API with Instagram Login flow. The Graph API itself is free, but Meta app review is required before your app exits Development mode. Tokens are valid for 60 days and must be refreshed via the long-lived token refresh endpoint.

Can the Instagram API return follower lists?

No — the Graph API returns the followers_count integer but never the list of follower user IDs, and never any follower data for accounts you don't own. This is by design, and the restriction has held since the 2018 Cambridge Analytica-era Graph API v2.0 tightening. If a tutorial claims otherwise, it is either out of date or describing a scraper.

Is scraping Instagram legal in 2026?

In the United States, scraping public, logged-out Instagram data has been found legally defensible in Meta v. Bright Data (N.D. Cal. Jan. 23, 2024) and is consistent with the Ninth Circuit's ruling in hiQ Labs v. LinkedIn, 31 F.4th 1180 (9th Cir. 2022). Those rulings cover CFAA claims on public data only; they do not address GDPR, the UK DPA, Brazil's LGPD, or any non-US regime, and they do not authorize logged-in scraping, fake accounts, or access to private data. This article is not legal advice — consult qualified counsel for your jurisdiction and use case.

How do I scrape Instagram comments at scale?

Use Apify's apify/instagram-comment-scraper actor or Instaloader's get_comments() method. Budget 2-5x more proxy credit per post than profile scraping — comment endpoints are rate-limited more aggressively because they are the highest-value target for spam detection. SocialCrawl's Instagram scraper API wraps both options behind one unified comments endpoint.

Instagram API vs Instagram Graph API — what's the difference?

They are the same thing in 2026. "Instagram API" is the umbrella term Meta uses in marketing; the Instagram Graph API is the current REST implementation and the only supported path for new integrations. The two phrases are interchangeable in Meta's own Instagram Platform docs.