Instagram Access Token: 60-Day Expiry, Refresh, Code 190
A long-lived Instagram access token lasts 60 days and can be refreshed indefinitely. This guide shows you how to generate one through the Facebook Developer Console, how to refresh it on a schedule, and why 42 of our last 43 broken tokens died before their expiry date — along with what each code 190 message actually means.
Or let Feedframer do the eight steps below: one OAuth click, no Facebook app to create, and the 60-day token refreshed for you. The free plan is 1 Instagram account, your 6 most recent posts and unlimited API requests — no credit card. You will need an Instagram Business or Creator account either way.
What Is an Instagram Access Token?
An Instagram access token is a secure key that authorises API requests to read data from an Instagram account — posts, captions, media, and insights — through the Instagram Graph API for Business and Creator accounts. Any app or website that pulls Instagram content programmatically needs one.
There are two types. A short-lived token is issued during login and expires after about 1 hour. A long-lived access token lasts 60 days and can be refreshed — this is what almost every real integration uses. The steps below show how to get a long-lived Instagram access token for free using the Facebook Developer Console.
Video Tutorial
Step-by-Step Instructions
Create a New Facebook App
Visit developers.facebook.com/apps/creation and create a new app.
- • Select "Other" as the use case
- • Select "Business" as the app type
Add Your Instagram Account as a Tester
Once your app is created, go to App Roles and add your Instagram account as a tester.
Accept the Invitation on Instagram
Head over to instagram.com/accounts/manage_access and accept the invitation from your app.
Set Up Instagram API in Developer Console
Back in the Facebook Developer Console, click on Instagram and then API Setup with Instagram Business Login.
Generate Your Access Token
You'll be able to generate a long-lived access token directly from the interface.
💡 Test Your Token
Verify your access token at developers.facebook.com/tools/debug/accesstoken
How to Refresh a Long-Lived Access Token
Exchange the current token for a new one with a single GET request. You don't need your app secret: the token authorises its own refresh.
curl -G https://graph.instagram.com/refresh_access_token \
-d grant_type=ig_refresh_token \
-d access_token=YOUR_LONG_LIVED_TOKENInstagram replies with a new token and its lifetime in seconds (5,183,944 is just under 60 days):
{
"access_token": "IGAA...",
"token_type": "bearer",
"expires_in": 5183944
}- The token must be at least 24 hours old and not yet expired. Once the 60 days run out, refreshing stops working and the owner has to log in again.
- Save the
access_tokenfrom the response, and work out the new expiry fromexpires_inrather than assuming 60 days. - Refresh on a schedule, not when a request fails. Feedframer checks hourly and refreshes anything due to expire within 7 days, which leaves room for retries if Instagram has a bad day.
Why Your Instagram Access Token Stopped Working
Refreshing on time is not enough on its own, and expiry is almost never the thing that breaks you. On 4 October 2026, Feedframer had 43 connected Instagram accounts in a dead-token state. 42 of them broke before their token's recorded expiry date, and 7 were still holding a token that was in date that day. Expiry explained exactly one failure out of 43. Something on the account side killed the rest first.
Here is how often we see each cause, counted from the failed Instagram API calls behind those accounts:
| What actually happened | Failures | Can a refresh fix it? |
|---|---|---|
| The account owner changed their Instagram password | 20 | No — needs a fresh login |
| The owner removed your app in Instagram settings | 16 | No — needs a fresh login |
| Instagram is holding the account behind a checkpoint | 4 | Not yet — the owner clears it on instagram.com |
| A transient Instagram error (is_transient: true) | 4 | Yes — retry on a backoff |
| The 60-day token genuinely expired | 1 | Too late — refresh earlier next time |
The counts are failed API calls rather than a clean split of the 43 accounts — one account can fail more than once, and a few failed without leaving a usable message. The ranking is the point: password changes and removed app access cause roughly nine in ten of these breakages, and no amount of refreshing on schedule prevents either one.
Every one of these failures comes back as an OAuthException with code 190. Meta's error docs list subcodes for telling them apart, but in our logs graph.instagram.com sends error_subcode: 0 for all of them. The message text is the only signal you get:
{
"error": {
"message": "Error validating access token: The user has not authorized application 1234567890.",
"type": "OAuthException",
"code": 190,
"error_subcode": 0
}
}These are the messages we actually see in production, what causes each one, and what fixes it:
Error validating access token: The user has not authorized application {app-id}.
Cause: The account owner removed your app from their Instagram account, so every token issued to it is dead.
Fix: Ask the owner to log in through your app again. Refreshing will keep failing.
Error validating access token: The session has been invalidated because the user changed their password or Facebook has changed the session for security reasons.
Cause: The owner changed their password, or Meta reset their sessions after a security event.
Fix: Ask the owner to log in through your app again. The old token will not come back.
Error validating access token: This Instagram account needs to complete a checkpoint before it can access this app. To recover access, log in to www.instagram.com and follow the instructions.
Cause: Instagram has flagged the account, usually after a suspicious login, and is holding it until the owner verifies it.
Fix: Ask the owner to log in on instagram.com and complete the check, then retry the same token.
Error validating access token: You cannot access the app till you log in to www.instagram.com and follow the instructions given.
Cause: Instagram is holding the account behind a prompt that the owner has to deal with on instagram.com before any app can use it.
Fix: Ask the owner to log in on instagram.com and clear the prompt, then retry the same token.
The split that matters is between errors that clear up and errors that never will. A revoked app or a changed password means a new login, full stop. The checkpoint and login prompts can clear once the owner deals with them, so retry those on a backoff before you ask anyone to reconnect:
function classifyTokenError(body) {
const error = body?.error;
if (error?.code !== 190) return 'other';
// Instagram is asking the owner to clear a prompt on instagram.com.
// Once they do, the same token can start working again.
if (/checkpoint|log in to www\.instagram\.com/i.test(error.message)) {
return 'retry-later';
}
// Revoked, password changed or expired: only a fresh login fixes these.
return 'reconnect';
}Each of these messages has its own cause, its own fix, and its own frequency. We broke them down one by one, with the production counts, in the Instagram API error 190 reference.
Important Things to Know
Access Tokens Expire After 60 Days
Instagram long-lived access tokens are valid for 60 days. You must refresh them before they expire to maintain access to your data. This requires setting up automated refresh logic or manual intervention every two months.
Media URLs Expire Quickly
The image and video URLs returned by Instagram's API are temporary and will expire. You cannot rely on these URLs for long-term storage or display.
Best practice: Either download and host the media yourself, or use a service like Feedframer that automatically handles media URL refreshing and provides permanent CDN URLs.
Feedframer Handles All of This Automatically
While it's possible to manage Instagram tokens manually, it requires constant maintenance and monitoring. With Feedframer, all token management happens automatically in the background:
Automatic Token Refresh
We refresh your tokens before they expire, so you never lose access.
Permanent Media URLs
All images and videos are cached on our CDN with permanent URLs.
Secure Token Storage
Tokens encrypted at rest with industry-standard encryption.
Expiration Monitoring
Dashboard shows token health and upcoming expirations.
Email Notifications
Automatic alerts if token refresh fails or re-auth needed.
No Maintenance Required
Set it up once and forget about it. We handle everything.
Focus on building your product. Let us handle the Instagram API complexity, token management, and media hosting.
Start Free - No Credit Card RequiredFrequently Asked Questions
How do I get an Instagram access token?
Create a Facebook app at developers.facebook.com, add your Instagram Business or Creator account as a tester, set up the Instagram API with Instagram Business Login, then generate a long-lived access token from the developer console. Follow the step-by-step instructions above.
What's the difference between a short-lived and long-lived token?
A short-lived token is issued during login and expires after about 1 hour. A long-lived access token lasts 60 days and can be refreshed, which is what almost every real Instagram integration uses.
Do I need a Facebook account to get an Instagram access token?
Yes. The Instagram Graph API is administered through Meta, so generating an access token requires a Facebook account and a Facebook app, plus an Instagram Business or Creator account connected to it.
How long does a long-lived access token last?
Long-lived tokens are valid for 60 days. They must be refreshed before expiration to maintain access.
What happens if my token expires?
If a token expires, you must go through the authorization process again to generate a new token. This is why automated refresh (or using Feedframer) is critical.
Can I refresh an expired Instagram access token?
No. The refresh endpoint only accepts a long-lived token that is at least 24 hours old and has not yet expired. Once the 60 days run out, the account owner has to log in again to issue a new token.
Why does Instagram say "The user has not authorized application"?
The account owner has removed your app from their Instagram account, so every token issued to it is dead. Refreshing cannot fix it. The owner has to log in through your app again to grant a new token. This is the second most common cause we see — 16 of the failures behind our 43 dead-token accounts on 4 October 2026.
What does "The session has been invalidated because the user changed their password" mean?
The account owner changed their Instagram password, or Meta reset their sessions after a security event. Every token issued before that moment is dead, including tokens with weeks left on the 60-day clock, and refresh_access_token cannot revive one. The owner has to log in through your app again. This is the single most common cause we see — 20 of the failures behind our 43 dead-token accounts on 4 October 2026.
What does "You cannot access the app till you log in to www.instagram.com" mean?
Instagram is holding the account behind a checkpoint, usually after a suspicious login, and no app can read it until the owner clears that prompt. Sending them a reconnect link will not help: the OAuth login itself is blocked until the check is done. The owner has to log in on instagram.com and follow the instructions there, after which the existing token can start working again. Retry it on a backoff instead of asking anyone to reconnect.
Does a 60-day expiry cause most Instagram token failures?
No. On 4 October 2026 we had 43 connected Instagram accounts in a dead-token state, and 42 of them broke before their token's recorded expiry date. Expiry explained one. The dominant causes are a changed Instagram password (20 failures) and the app being removed in Instagram settings (16). Refreshing on schedule prevents neither — it only protects you from the one.
Why do Instagram media URLs expire?
For security and privacy reasons, Instagram's CDN URLs for images and videos are temporary. They typically expire within a few hours to days. You should either download and host the media yourself, or use a service like Feedframer that handles this automatically.
Does Feedframer give me access to my token?
Yes. Your long-lived access token is displayed in the Feedframer dashboard. You can use it for direct Instagram API calls if needed, though we handle all post fetching and media hosting automatically.
Do I need to be a developer to use Feedframer?
No. While understanding access tokens helps, Feedframer handles all the technical complexity for you. Simply connect your Instagram account and we'll manage everything else automatically.
Related Resources
Skip the Token Management Headache
Let Feedframer handle the token refresh, the media hosting and the API. The free plan covers 1 Instagram account and your 6 most recent posts; Premium is $6/month for 5 accounts and 100 posts each.