Instagram API & Scrapers in 2026: What Still Works
Instagram scraping in 2026: what still works, what broke, real Graph API rate limits, legal precedent, and every scraper option compared for developers.
Instagram API & Scrapers in 2026: What Still Works
TL;DR — as of April 2026
- The Instagram Basic Display API is dead (shut down December 4, 2024).
- The Instagram Graph API works for Business/Creator accounts only: 200 calls/hour/user, Meta app review required.
- Scraping public, logged-out Instagram data was ruled not a CFAA violation in Meta v. Bright Data (N.D. Cal. Jan. 2024) — consistent with the Ninth Circuit's hiQ Labs v. LinkedIn ruling.
- SocialCrawl is the compliant, unified alternative: one schema across 21 platforms, computed fields for AI agents, managed rate limits.
- Decision tree below: pick your path in under two minutes.
This article is a technical overview, not legal advice. Laws and platform terms vary by jurisdiction — consult qualified counsel before building on public data.
The Instagram API landscape in April 2026 looks nothing like 2023. Instagram reached 3 billion monthly active users in September 2025 (Reuters), making it the second-largest social network on earth after Facebook's 3.07B MAU, and the gap between what Meta's docs describe and what actually works has never been wider.
What changed in 2024-2026?
The Basic Display API shut down on December 4, 2024. Meta announced the deprecation on September 4, 2024, killing embed widgets, personal-account OAuth flows, and social-login integrations with no migration path. Meta's own developer navigation still lists Basic Display — which is how stale tutorials keep citing dead endpoints 16 months later.
January 27, 2025: the scope rename. Meta deprecated the old scope names (business_basic, business_content_publish, etc.) and replaced them with instagram_business_-prefixed values on the Instagram API with Instagram Login reference. Apps that didn't update got silent 403s for two weeks before Meta rolled back the enforcement grace period.
Cambridge Analytica is still shaping API policy. Meta removed more than 400 apps from the platform during the 2018 app investigation, and every scope-tightening since — including the 2024-2025 Instagram changes — traces back to that audit. The Graph API v22 (March 2026) tightened instagram_graph_user_profile again, narrowing fields returned on unowned Business accounts.
Four new scraping defenses landed in 2024-2025. Datacenter IPs are blocked on first request, Python's requests and httpx libraries are blocked by TLS fingerprinting, the internal GraphQL doc_id parameter rotates every 2-4 weeks, and behavioral ML flags unnatural request timing. Plain BeautifulSoup scripts no longer work — period.
Does the official Instagram API still work in 2026?
Yes, with reduced scope — the Graph API works, but only for Business and Creator accounts, and only through two official paths that both require Meta app review.
Instagram API with Instagram Login is the designated replacement for Basic Display. No linked Facebook Page is required. It covers comment moderation, publishing, insights, and messaging for accounts that have authorized your app via OAuth.
Instagram API with Facebook Login requires a linked Facebook Page but unlocks hashtag search and basic business discovery metadata (follower count, bio, media count) for other Business/Creator accounts without their OAuth approval — the only official endpoint that supports competitor monitoring.
Both paths require Meta app review and share a rate limit of 200 calls per hour per user access token, as documented in Meta's Platform Rate Limits reference. The limit is per user, not per app — an app with 500 connected Business accounts can aggregate to 100,000 calls/hour. What the Instagram Graph API will never give you: full follower lists, historical post insights on competitor accounts, or any data from personal accounts.
# Graph API: fetch your own media
curl -X GET \
"https://graph.instagram.com/v22.0/{ig-user-id}/media?fields=id,caption,media_type,timestamp,like_count,comments_count&access_token={user-access-token}"For an instagram api key, register a Meta App at developers.facebook.com and generate a long-lived user token. Expect 429 on rate limits, 401 on expired tokens, 400 on stale scope names.
Which Instagram scrapers still work in 2026?
Four scrapers still work reliably on public data — Instaloader, Apify, Bright Data, and SocialCrawl — and every one of them hits Instagram's internal REST (i.instagram.com/api/v1/users/web_profile_info) or GraphQL endpoints rather than the official Graph API. The GraphQL path needs a doc_id that rotates every 2-4 weeks. Residential proxies plus TLS fingerprint spoofing via curl_cffi impersonating Chrome are mandatory for any self-hosted approach.
Instaloader is the most maintained open-source Instagram scraper on GitHub: 12,100 stars, v4.15.1, last commit April 11, 2026. Fine for research, painful for production. Any Python Instagram scraper written from scratch should start from curl_cffi, never requests.
Apify Instagram Scraper (apify/instagram-scraper) is the managed cloud option at ~$1.50 per 1,000 results. Dedicated actors cover apify/instagram-reel-scraper, apify/instagram-comment-scraper, and apify/instagram-hashtag-scraper. Catch: raw data, no computed fields, platform-specific shapes.
Bright Data matters because of the court case. In Meta Platforms, Inc. v. Bright Data Ltd., No. 3:23-cv-00077 (N.D. Cal. Jan. 23, 2024), Judge Edward M. Chen granted summary judgment for Bright Data on Meta's contract claims for data collected while logged out:
"Meta has no protectable interest in public data that it does not own... Scraping of public website data is not actionable under the CFAA where the scraper does not bypass a technological access barrier." — Judge Edward M. Chen, Meta Platforms, Inc. v. Bright Data Ltd. (N.D. Cal. Jan. 23, 2024) (opinion PDF)
The ruling is consistent with the Ninth Circuit's precedent in hiQ Labs v. LinkedIn, where the court held:
"It is likely that when a computer network generally permits public access to its data, a user's accessing that publicly available data will not constitute access without authorization under the CFAA." — hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022) (Justia opinion)
Both cases are US federal decisions. They do not speak to GDPR, the UK Data Protection Act, or any non-US regime — and neither shields anyone who logs in, bypasses a technological barrier, or scrapes private data. Tech-law scholar Eric Goldman's analysis of the Bright Data ruling is the most-cited commentary and worth reading before you build.
SocialCrawl wraps working scrapers in a unified REST API. The Graph API returns timestamp, Apify returns taken_at_timestamp, Instaloader returns date_utc — three different field names for the same value. SocialCrawl normalizes them to one schema and adds computed fields (engagement_rate, estimated_reach, content_category, language) so AI agents reason directly from the payload with zero ETL. See your data before writing a single line of integration code in the Instagram endpoint docs.
# SocialCrawl: one schema, all 21 platforms
curl -X GET \
"https://socialcrawl.dev/v1/instagram/profile?username=username_here" \
-H "x-api-key: YOUR_SOCIALCRAWL_KEY"Instagram profile scraper, instagram hashtag scraper, instagram comment scraper, ig lead scraper, and instagram reels scraper use cases all collapse to the same three choices: Instaloader + proxies, Apify per result, or SocialCrawl. If you need to pipe this data into an autonomous workflow, see how to build an AI agent for social media monitoring.
Which approach should you pick?
Your choice collapses to one question: do you own the account? Owners use the Graph API, everyone else uses a scraper, and anyone who needs more than one platform uses SocialCrawl.
Prose version: Own a Business/Creator account? Use the Instagram Graph API. Personal account? Convert to Creator in five minutes, then use the Graph API. Don't own the account? Under 1K req/day, Instaloader; 1K-50K req/day, Apify or SocialCrawl; AI pipelines or multi-platform analytics, SocialCrawl. Any Instagram analytics stack for competitor work combines Graph API data (your own accounts) with scraper data — the hybrid approach is the only way to get Instagram analytics for accounts you don't control. For a broader look at how all major platforms compare, see our ultimate guide to social media APIs in 2026.
| Approach | Works in 2026? | Account types | Rate limit | App review? | Cost |
|---|---|---|---|---|---|
| Graph API (Instagram Login) | Yes | Business, Creator | 200 req/hr per token | Yes | Free |
| Graph API (Facebook Login) | Yes | Business, Creator + FB Page | 200 req/hr per token | Yes | Free |
| Instaloader | Yes (with caveats) | Public + private (login) | ~200 req/hr per IP | No | Free |
| Apify Instagram Scraper | Yes | Public | Managed | No | ~$1.50/1K results |
| SocialCrawl | Yes | Public, unified schema + computed fields | Managed | No | Credit-based, free tier |
| Basic Display API | NO — DEAD | — | — | — | Dead since December 4, 2024 |
Frequently Asked Questions
Can you use the Instagram API for personal accounts?
No — there is no official API for personal accounts in 2026. The Instagram Basic Display API, which was the only path for personal accounts, shut down on December 4, 2024. The only official alternative is converting the account to Creator (free, takes five minutes) and using the Graph API.
How do you get an Instagram API key?
Register a Meta App at developers.facebook.com and generate a long-lived user access token via the Instagram API with Instagram Login flow. The Graph API itself is free, but Meta app review is required before your app exits Development mode. Tokens are valid for 60 days and must be refreshed via the long-lived token refresh endpoint.
Can the Instagram API return follower lists?
No — the Graph API returns the followers_count integer but never the list of follower user IDs, and never any follower data for accounts you don't own. This is by design, and the restriction has held since the 2018 Cambridge Analytica-era Graph API v2.0 tightening. If a tutorial claims otherwise, it is either out of date or describing a scraper.
Is scraping Instagram legal in 2026?
In the United States, scraping public, logged-out Instagram data has been found legally defensible in Meta v. Bright Data (N.D. Cal. Jan. 23, 2024) and is consistent with the Ninth Circuit's ruling in hiQ Labs v. LinkedIn, 31 F.4th 1180 (9th Cir. 2022). Those rulings cover CFAA claims on public data only; they do not address GDPR, the UK DPA, Brazil's LGPD, or any non-US regime, and they do not authorize logged-in scraping, fake accounts, or access to private data. This article is not legal advice — consult qualified counsel for your jurisdiction and use case.
How do I scrape Instagram comments at scale?
Use Apify's apify/instagram-comment-scraper actor or Instaloader's get_comments() method. Budget 2-5x more proxy credit per post than profile scraping — comment endpoints are rate-limited more aggressively because they are the highest-value target for spam detection. SocialCrawl's unified comments endpoint wraps both options.
Instagram API vs Instagram Graph API — what's the difference?
They are the same thing in 2026. "Instagram API" is the umbrella term Meta uses in marketing; the Instagram Graph API is the current REST implementation and the only supported path for new integrations. The two phrases are interchangeable in Meta's own Instagram Platform docs.
Related posts
How to Use Claude Agents: A Developer's Guide to Managed Agents, Sub-agents, and Real-time Data
A developer's guide to Claude Managed Agents, Claude Code sub-agents, and the Messages API. Setup in 4 steps, parallel execution, MCP, rate limits.
The OpenAI Assistants API in 2026: A Field Guide to the Shutdown, the Migration, and What Comes Next
OpenAI shuts down the Assistants API on 26 August 2026. A practical migration guide: Responses API, costs, frameworks, and the realistic timeline.
Browse AI Web Scraper: Where It Wins, and Where Social Data APIs Fit Better
Browse AI is great for web pages; social platforms need a specialist. Decision guide for developers choosing scrapers vs unified social-data APIs.