Instagram API Error 190

Code 190 means your Instagram access token is no longer usable, and the message text — not the code — tells you why. Meta documents error subcodes for distinguishing these, but in our production logs graph.instagram.com returns error_subcode: 0 for every single one. The string is all you get:

{
  "error": {
    "message": "Error validating access token: The session has been invalidated because the user changed their password or Facebook has changed the session for security reasons.",
    "type": "OAuthException",
    "code": 190,
    "error_subcode": 0
  }
}

Three of the five variants are permanent and need the account owner to log in again. One needs the owner to clear a prompt on instagram.com, during which a reconnect button cannot work. One is a transient blip you should simply retry. Sending the wrong message to the wrong user is how integrations lose trust.

Most guides rank these by how easy they are to explain. This is how they ranked in Feedframer's own logs on 4 October 2026, across the 43 connected Instagram accounts we then had in a dead-token state. Counts are failed API calls, not a clean split of the 43 — one account can fail more than once — so read the ranking, not the totals.

Because the subcode is useless on graph.instagram.com, classification comes down to the message text plus the is_transient flag. This is the shape we use:

function classify190(body) {
  const error = body?.error;
  if (error?.code !== 190) return 'not-a-token-problem';

  const message = error.message ?? '';

  // Instagram is holding the account. A reconnect cannot succeed yet,
  // because the OAuth login itself is blocked until the owner clears it.
  if (/checkpoint|log in to www\.instagram\.com/i.test(message)) {
    return 'blocked-retry-later';
  }

  // Meta tells you when it is worth retrying the same token.
  if (error.is_transient === true) return 'retry-with-backoff';

  // Password change, revoked app, genuine expiry: only a fresh login fixes it.
  return 'needs-reconnect';
}

Matching on English error strings is fragile, and we would rather not — but Meta gives you nothing more reliable here. Log the raw message on every failure so that when the wording changes, you find out from your own logs instead of from a customer.

One more trap: a 30-second timeout talking to Instagram is not a token error. If your HTTP client throws before it ever sees a response body, do not mark the connection broken — retry it. We got this wrong ourselves, and it inflated our own broken-account count badly enough to distort the table above until we separated the two.