## Question
How should Instagram API token refresh be scheduled and recovered after expiry?
## Why this matters
Recurring public developer task for Instagram API.
## Environment / product
Instagram API
## What needs to be determined
Current researched guidance, applicability, limitations, and primary sources for this question.
Researched guidance is proposed, not an execution report.
Problem details
- Observed symptom
- How should Instagram API token refresh be scheduled and recovered after expiry?
- Context
- Recurring public developer task; researched guidance is proposed, not an execution report.
- Environment
- Unknown · not established
- Symptom signature
- Literal source
- Not supplied
- Expected behavior
- Not supplied
Known approaches
solution · Revision 1
Researched guidance: How should Instagram API token refresh be scheduled and recovered after expiry?
## Summary
Research-only guidance: schedule Instagram token maintenance from each token’s returned expiry, refresh valid long-lived Instagram-Login tokens before expiry, and route expired or invalid tokens to reauthorization. Meta does not publish one universal recurring interval, and its current pages disagree about the standalone refresh reference, so bind behavior to the exact login configuration and API version.
## Candidate action
Keep a server-side token record containing the flow/configuration, token class, received_at, expires_at derived from the response expires_in, granted permissions, and a reauthorization-needed state; never expose token values or app secrets. Run a bounded maintenance job that refreshes an eligible, unexpired long-lived Instagram User token inside an operator-chosen safety window before expires_at, only after the documented minimum age where applicable. On success, atomically replace the token and recompute expires_at from the new expires_in. If refresh is rejected because the token is expired, invalid, revoked, the permission/flow is wrong, or the endpoint is unsupported, stop retries and send the user through the matching login/reauthorization flow; do not treat a web report as an execution result.
## Applicability
- Instagram API with Instagram Login/Business Login: short-lived tokens are documented as one hour and can be exchanged server-side for long-lived tokens valid 60 days; the Business Login guide documents GET https://graph.instagram.com/refresh_access_token with grant_type=ig_refresh_token for another 60 days while the long-lived token remains eligible.
- The standalone refresh reference says the token must be at least 24 hours old and unexpired, and returns expires_in; use those conditions when relying on that reference. Meta’s Business Login guide instead says the token is about to expire and that an unrefreshed token expires after 60 days and can no longer be refreshed.
- Facebook Login for Business is a different token path: the Instagram-specific onboarding page exposes short-lived and long-lived fields but does not document an Instagram-specific exchange or refresh endpoint; the generic Facebook Login guidance says SDKs refresh on use, non-SDK apps must implement refresh, and an expired User token requires the login flow again.
## Procedure
- Immediately after login/exchange, persist the token class and the returned expires_in-derived deadline; do not calculate from a hard-coded 60-day constant because Meta documents durations and flows separately.
- Schedule a recurring check often enough to honor the selected safety margin, but treat the interval as an application policy because Meta specifies no universal refresh schedule. Refresh only before expiry and only when the token and endpoint match the selected flow; avoid concurrent refreshes with a per-account lock or equivalent.
- For Instagram Login, call GET https://graph.instagram.com/refresh_access_token?grant_type=ig_refresh_token&access_token=... with the valid long-lived token, protecting the token in server-side handling. Respect the documented age/expiry prerequisites and persist the returned access_token and expires_in as one update.
- On transient transport or rate-limit failures, use bounded backoff within the remaining validity window and alert before expiry; do not blindly retry OAuth or permission errors. If the token is already expired or otherwise invalid, mark it non-refreshable and initiate the matching user login/reauthorization instead of attempting indefinite refresh.
- For Facebook Login for Business, use the flow’s documented Facebook User/Page token and inspect its documented expiry/data-access fields; do not assume the Instagram-Login graph.instagram.com refresh endpoint applies. Reauthorize when the Facebook User token or data access has expired, following the Facebook Login flow.
## Key findings
- Business Login documentation states short-lived tokens are valid for 1 hour, long-lived tokens for 60 days, and valid long-lived tokens can be refreshed for another 60 days; tokens not refreshed in 60 days expire and cannot be refreshed. (S1, S4)
- The standalone refresh reference documents GET /refresh_access_token, grant_type=ig_refresh_token, a valid unexpired long-lived token at least 24 hours old, and a returned expires_in, but also says “This operation is not supported.” (S2)
- The access-token reference requires a valid unexpired short-lived token and app secret for the server-side exchange to a 60-day long-lived token, and documents no automatic or recurring refresh schedule. (S3)
- The Instagram API overview distinguishes Instagram Login (Instagram User, graph.instagram.com) from Facebook Login for Business (Facebook User or Page, graph.facebook.com); the Facebook-login Instagram page does not document a refresh endpoint. (S5, S7)
- Generic Facebook Login guidance says SDKs refresh User tokens on use, non-SDK apps must refresh manually, expired User tokens require login again, and separate data access expiry can require reauthorization. (S6)
## Known limitations
- Meta’s Business Login guide documents the refresh endpoint and another 60-day lifetime, while the standalone Refresh Access Token reference repeats “This operation is not supported” despite documenting the endpoint, prerequisites, and response. This unresolved documentation conflict means endpoint support must be verified for the exact configuration/version; no claim of universal support is made.
- Meta documents no recurring refresh interval, safety margin, retry policy, locking strategy, or exact error mapping for expired/invalid Instagram tokens. Those are implementation recommendations, not Meta-observed behavior.
- The Instagram-specific Facebook Login for Business page does not document a fixed long-lived-token lifetime, refresh endpoint, or post-expiry recovery. Generic Facebook Login guidance is not a substitute for an Instagram-specific contract.
- No live API request, token, account, execution outcome, PASS/FAIL, or independent reproduction was available.
## Obsolete approaches
- Do not hard-code a single refresh cadence or assume every Instagram API configuration uses the Instagram-Login token endpoint.
- Do not attempt to refresh an already expired long-lived token indefinitely; Meta’s Business Login guide says an unrefreshed token expires and can no longer be refreshed.
- Do not put client secrets or token-refresh requests in client-side code; the documented short-lived-to-long-lived exchange requires server-side handling.
## Negative results
- The reviewed Instagram get-started and overview pages do not provide a universal refresh schedule or a complete expired-token recovery algorithm.
- The Instagram Facebook-Login onboarding page does not provide an Instagram-specific refresh/exchange endpoint; generic Facebook Login documentation must remain clearly separated from it.
## Evidence boundary
- basis=researched_guidance; executed=false; independent_reproduction=false. This submission summarizes public Meta documentation only and is not a live verification or PASS/FAIL result.
- Reported token lifetimes, endpoint names, prerequisites, and documentation disagreements are preserved per source; the scheduling margin, storage/locking pattern, bounded retry, and reauthorization state machine are proposed engineering guidance, not observed outcomes.
## What remains unknown
- Whether GET /refresh_access_token is currently enabled for every Instagram Login/Business Login app and API version, given the contradictory standalone reference wording.
- The exact error payloads and retryability for too-young, expired, revoked, malformed, permission-mismatched, or unsupported Instagram tokens.
- The exact refresh/exchange and post-expiry behavior for Instagram API with Facebook Login for Business in the current API version.
- Whether Meta changes token lifetimes, eligibility, permissions, or endpoint behavior without the reviewed pages being updated in sync.
## Evidence
- basis: researched_guidance
- executed: false
- independent reproduction: false
## Sources
- [S1] Business Login for Instagram Platform — https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/business-login/ (official_documentation; accessed 2026-09-26)
- [S2] Reference | Refresh Access Token — https://developers.facebook.com/docs/instagram-platform/reference/refresh_access_token/ (official_documentation; accessed 2026-09-26)
- [S3] Meta for Developers Reference | Access Token — https://developers.facebook.com/docs/instagram-platform/reference/access_token/ (official_documentation; accessed 2026-09-26)
- [S4] Get Started the Instagram API with Instagram Login — https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/get-started/ (official_documentation; accessed 2026-09-26)
- [S5] Overview of the Instagram API — https://developers.facebook.com/docs/instagram-platform/overview/ (official_documentation; accessed 2026-09-26)
- [S6] Authentication Versus Data Access — https://developers.facebook.com/docs/facebook-login/auth-vs-data/ (official_documentation; accessed 2026-09-26)
- [S7] Facebook Login for Business — https://developers.facebook.com/docs/instagram-platform/instagram-api-with-facebook-login/business-login-for-instagram/ (official_documentation; accessed 2026-09-26)
- Problem id
- 0d6c5ab2-b68c-4c0c-96b6-a206540e9aba
- Proposed action
- Keep a server-side token record containing the flow/configuration, token class, received_at, expires_at derived from the response expires_in, granted permissions, and a reauthorization-needed state; never expose token values or app secrets. Run a bounded maintenance job that refreshes an eligible, unexpired long-lived Instagram User token inside an operator-chosen safety window before expires_at, only after the documented minimum age where applicable. On success, atomically replace the token and recompute expires_at from the new expires_in. If refresh is rejected because the token is expired, invalid, revoked, the permission/flow is wrong, or the endpoint is unsupported, stop retries and send the user through the matching login/reauthorization flow; do not treat a web report as an execution result.
- Applicability
- State
- partial
- Text
- Instagram API with Instagram Login/Business Login: short-lived tokens are documented as one hour and can be exchanged server-side for long-lived tokens valid 60 days; the Business Login guide documents GET https://graph.instagram.com/refresh_access_token with grant_type=ig_refresh_token for another 60 days while the long-lived token remains eligible. The standalone refresh reference says the token must be at least 24 hours old and unexpired, and returns expires_in; use those conditions when relying on that reference. Meta’s Business Login guide instead says the token is about to expire and that an unrefreshed token expires after 60 days and can no longer be refreshed. Facebook Login for Business is a different token path: the Instagram-specific onboarding page exposes short-lived and long-lived fields but does not document an Instagram-specific exchange or refresh endpoint; the generic Facebook Login guidance says SDKs refresh on use, non-SDK apps must implement refresh, and an expired User token requires the login flow again.
- Limitations
- State
- partial
- Text
- Meta’s Business Login guide documents the refresh endpoint and another 60-day lifetime, while the standalone Refresh Access Token reference repeats “This operation is not supported” despite documenting the endpoint, prerequisites, and response. This unresolved documentation conflict means endpoint support must be verified for the exact configuration/version; no claim of universal support is made. Meta documents no recurring refresh interval, safety margin, retry policy, locking strategy, or exact error mapping for expired/invalid Instagram tokens. Those are implementation recommendations, not Meta-observed behavior. The Instagram-specific Facebook Login for Business page does not document a fixed long-lived-token lifetime, refresh endpoint, or post-expiry recovery. Generic Facebook Login guidance is not a substitute for an Instagram-specific contract. No live API request, token, account, execution outcome, PASS/FAIL, or independent reproduction was available.
- Success criteria
- Not supplied
- Risk notes
- Not supplied
- Lifecycle
- active
- Pack
- Schema version
- 1
- Candidate action
- Keep a server-side token record containing the flow/configuration, token class, received_at, expires_at derived from the response expires_in, granted permissions, and a reauthorization-needed state; never expose token values or app secrets. Run a bounded maintenance job that refreshes an eligible, unexpired long-lived Instagram User token inside an operator-chosen safety window before expires_at, only after the documented minimum age where applicable. On success, atomically replace the token and recompute expires_at from the new expires_in. If refresh is rejected because the token is expired, invalid, revoked, the permission/flow is wrong, or the endpoint is unsupported, stop retries and send the user through the matching login/reauthorization flow; do not treat a web report as an execution result.
- Applicability
- Instagram API with Instagram Login/Business Login: short-lived tokens are documented as one hour and can be exchanged server-side for long-lived tokens valid 60 days; the Business Login guide documents GET https://graph.instagram.com/refresh_access_token with grant_type=ig_refresh_token for another 60 days while the long-lived token remains eligible.
The standalone refresh reference says the token must be at least 24 hours old and unexpired, and returns expires_in; use those conditions when relying on that reference. Meta’s Business Login guide instead says the token is about to expire and that an unrefreshed token expires after 60 days and can no longer be refreshed.
Facebook Login for Business is a different token path: the Instagram-specific onboarding page exposes short-lived and long-lived fields but does not document an Instagram-specific exchange or refresh endpoint; the generic Facebook Login guidance says SDKs refresh on use, non-SDK apps must implement refresh, and an expired User token requires the login flow again. - Limitations
- Meta’s Business Login guide documents the refresh endpoint and another 60-day lifetime, while the standalone Refresh Access Token reference repeats “This operation is not supported” despite documenting the endpoint, prerequisites, and response. This unresolved documentation conflict means endpoint support must be verified for the exact configuration/version; no claim of universal support is made.
Meta documents no recurring refresh interval, safety margin, retry policy, locking strategy, or exact error mapping for expired/invalid Instagram tokens. Those are implementation recommendations, not Meta-observed behavior.
The Instagram-specific Facebook Login for Business page does not document a fixed long-lived-token lifetime, refresh endpoint, or post-expiry recovery. Generic Facebook Login guidance is not a substitute for an Instagram-specific contract.
No live API request, token, account, execution outcome, PASS/FAIL, or independent reproduction was available. - Evidence boundary
- basis=researched_guidance; executed=false; independent_reproduction=false. This submission summarizes public Meta documentation only and is not a live verification or PASS/FAIL result.
Reported token lifetimes, endpoint names, prerequisites, and documentation disagreements are preserved per source; the scheduling margin, storage/locking pattern, bounded retry, and reauthorization state machine are proposed engineering guidance, not observed outcomes. - What remains unknown
- Whether GET /refresh_access_token is currently enabled for every Instagram Login/Business Login app and API version, given the contradictory standalone reference wording.
The exact error payloads and retryability for too-young, expired, revoked, malformed, permission-mismatched, or unsupported Instagram tokens.
The exact refresh/exchange and post-expiry behavior for Instagram API with Facebook Login for Business in the current API version.
Whether Meta changes token lifetimes, eligibility, permissions, or endpoint behavior without the reviewed pages being updated in sync. - Summary
- Research-only guidance: schedule Instagram token maintenance from each token’s returned expiry, refresh valid long-lived Instagram-Login tokens before expiry, and route expired or invalid tokens to reauthorization. Meta does not publish one universal recurring interval, and its current pages disagree about the standalone refresh reference, so bind behavior to the exact login configuration and API version.
- Steps
- Immediately after login/exchange, persist the token class and the returned expires_in-derived deadline; do not calculate from a hard-coded 60-day constant because Meta documents durations and flows separately.
Schedule a recurring check often enough to honor the selected safety margin, but treat the interval as an application policy because Meta specifies no universal refresh schedule. Refresh only before expiry and only when the token and endpoint match the selected flow; avoid concurrent refreshes with a per-account lock or equivalent.
For Instagram Login, call GET https://graph.instagram.com/refresh_access_token?grant_type=ig_refresh_token&access_token=... with the valid long-lived token, protecting the token in server-side handling. Respect the documented age/expiry prerequisites and persist the returned access_token and expires_in as one update.
On transient transport or rate-limit failures, use bounded backoff within the remaining validity window and alert before expiry; do not blindly retry OAuth or permission errors. If the token is already expired or otherwise invalid, mark it non-refreshable and initiate the matching user login/reauthorization instead of attempting indefinite refresh.
For Facebook Login for Business, use the flow’s documented Facebook User/Page token and inspect its documented expiry/data-access fields; do not assume the Instagram-Login graph.instagram.com refresh endpoint applies. Reauthorize when the Facebook User token or data access has expired, following the Facebook Login flow. - Obsolete approaches
- Do not hard-code a single refresh cadence or assume every Instagram API configuration uses the Instagram-Login token endpoint.
Do not attempt to refresh an already expired long-lived token indefinitely; Meta’s Business Login guide says an unrefreshed token expires and can no longer be refreshed.
Do not put client secrets or token-refresh requests in client-side code; the documented short-lived-to-long-lived exchange requires server-side handling. - Negative results
- The reviewed Instagram get-started and overview pages do not provide a universal refresh schedule or a complete expired-token recovery algorithm.
The Instagram Facebook-Login onboarding page does not provide an Instagram-specific refresh/exchange endpoint; generic Facebook Login documentation must remain clearly separated from it. - Key findings
- Text
- Business Login documentation states short-lived tokens are valid for 1 hour, long-lived tokens for 60 days, and valid long-lived tokens can be refreshed for another 60 days; tokens not refreshed in 60 days expire and cannot be refreshed.
- Source ids
- S1
S4
- Text
- The standalone refresh reference documents GET /refresh_access_token, grant_type=ig_refresh_token, a valid unexpired long-lived token at least 24 hours old, and a returned expires_in, but also says “This operation is not supported.”
- Source ids
- S2
- Text
- The access-token reference requires a valid unexpired short-lived token and app secret for the server-side exchange to a 60-day long-lived token, and documents no automatic or recurring refresh schedule.
- Source ids
- S3
- Text
- The Instagram API overview distinguishes Instagram Login (Instagram User, graph.instagram.com) from Facebook Login for Business (Facebook User or Page, graph.facebook.com); the Facebook-login Instagram page does not document a refresh endpoint.
- Source ids
- S5
S7
- Text
- Generic Facebook Login guidance says SDKs refresh User tokens on use, non-SDK apps must refresh manually, expired User tokens require login again, and separate data access expiry can require reauthorization.
- Source ids
- S6
- Research sources
- Id
- S1
- Title
- Business Login for Instagram Platform
- Url
- https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/business-login/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
- Id
- S2
- Title
- Reference | Refresh Access Token
- Url
- https://developers.facebook.com/docs/instagram-platform/reference/refresh_access_token/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
- Id
- S3
- Title
- Meta for Developers Reference | Access Token
- Url
- https://developers.facebook.com/docs/instagram-platform/reference/access_token/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
- Id
- S4
- Title
- Get Started the Instagram API with Instagram Login
- Url
- https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/get-started/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
- Id
- S5
- Title
- Overview of the Instagram API
- Url
- https://developers.facebook.com/docs/instagram-platform/overview/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
- Id
- S6
- Title
- Authentication Versus Data Access
- Url
- https://developers.facebook.com/docs/facebook-login/auth-vs-data/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
- Id
- S7
- Title
- Facebook Login for Business
- Url
- https://developers.facebook.com/docs/instagram-platform/instagram-api-with-facebook-login/business-login-for-instagram/
- Source class
- official_documentation
- Accessed at
- 2026-09-26
Page 1 · 1 children total
Sources and related records
No source relations recorded.