Instagram API with Instagram Login explained for website owners

What it is, in one paragraph

An API is a doorway that lets one piece of software ask another for information. Meta offers several doorways into Instagram. The “Instagram API with Instagram Login” is the one where you, the account owner, sign in with your Instagram username and password (not Facebook) and approve what an app may do. Meta’s documentation says it “allows Instagram professionals,” meaning businesses and creators, to manage their Instagram presence through an app. For a website feed, the app only needs to read your profile and your posts, so that it can show them on your site.

Two ways apps connect to Instagram

Meta’s overview of the Instagram Platform describes two setups. The difference is mostly about how you sign in and whether a Facebook Page is involved.

Meta’s page about the Instagram Login setup puts the main point directly: “This API setup does not require a Facebook Page to be linked to the Instagram professional account.” It also notes that this setup “cannot access ads or tagging.”

For website owners, the first two rows are what matter. If your business lives on Instagram and you never set up a Facebook Page, or you do not want to manage one, Instagram Login lets you connect anyway.

A short glossary

A few words come up again and again in Meta’s documentation and in feed tools’ dashboards. Here is what they mean for you.

Why this API matters for website feeds now

For years, many simple website feeds used a different API, the Instagram Basic Display API, which worked with personal accounts. Meta retired it, and feeds that depended on it stopped updating. Our post on the Instagram Basic Display API shutdown covers what changed and how to tell whether an old feed was affected.

Feed tools that still work today use one of the two setups in the table above. Social Feed by grip space uses the Instagram API with Instagram Login. In practice, that means you sign in with Instagram, you do not need a Facebook Page, and your account must be a professional account.

Who can use it: professional accounts only

Meta’s documentation for this API refers throughout to “Instagram professional accounts,” which Meta says “can be for a business or creator.” The getting-started guide lists the possible account_type values for a connected user as Business or Media_Creator. Personal accounts are not on that list.

If your account is personal, you do not need a new account: you switch the type of the one you have, and your followers and posts stay. Our guide to Instagram professional accounts walks through Business versus Creator and the switch itself. If your account is private, see can you show a private Instagram account on your website?; the short answer is no.

Once connected, the Social Feed dashboard shows each account’s type next to its username, so you can confirm at a glance which kind of account is linked.

What happens when you click “Connect”

Meta calls the sign-in process “Business Login for Instagram.” Behind the scenes it goes like this, according to Meta’s documentation:

1. The authorization window opens. The app sends you to an Instagram page that Meta describes as the window where “your app user uses this window to grant your app permissions.” You sign in to Instagram there, on Instagram’s own site. The app never sees your password.
2. You approve the request. The window lists what the app is asking for. These are the permissions, also called scopes, explained below.
3. Instagram sends the app a one-time code. Meta says this authorization code “is valid for 1 hour and can only be used once.”
4. The app exchanges the code for an access token. The first token is short-lived: Meta’s getting-started guide says tokens from the business login flow “are short-lived and valid for 1 hour.”
5. The app exchanges that for a long-lived token, which Meta says is “valid for 60 days.”
6. The app refreshes the token before it expires. Meta allows a long-lived token to be refreshed once it is at least 24 hours old and has not yet expired, as long as the account still grants the instagram_business_basic permission.

Social Feed by grip space follows this flow and renews the long-lived token automatically, so in normal use you connect once. If a token does expire or is cancelled, for example after a password change, you reconnect. Our article on an Instagram access token that has expired explains the signs and the exact steps.

The permissions, in plain English

Permissions decide what an app can do with your account. Meta’s documentation lists these scope values for the Instagram API with Instagram Login:

Meta’s permissions reference describes the allowed usage of the basic permission as getting “basic metadata of an Instagram Business account profile,” for example the username and ID, and lists no dependencies for it. The publishing, comments and messaging permissions each list the basic permission as a dependency, which is why every app that uses this API asks for it.

A note for anyone maintaining older code: Meta renamed these scopes. The old values business_basic, business_content_publish, business_manage_comments and business_manage_messages were replaced by the instagram_business_* names above, and Meta’s documentation says the old values “will be deprecated on January 27, 2025,” warning that failing to update “will result in your app being unable to call the Instagram endpoints.” If a homemade integration stopped working around then, that may be why.

Exactly what Social Feed by grip space asks for

Social Feed requests one permission: instagram_business_basic. Nothing else. It cannot publish posts, reply to or delete comments, read or send direct messages, or read your account insights, because it never asks for those permissions.

With that one permission, the service reads:

It does not read your followers list, who liked your posts, the text of comments, your messages, your Stories, or anything from other accounts. Feeds show one connected account per widget, and there are no hashtag feeds. That last point also follows from the API itself: as the comparison table shows, hashtag search is not supported with Instagram Login.

The images and videos on your site load directly from Instagram’s servers, and the widget itself sets no cookies and uses no local storage in your visitors’ browsers.

What Instagram Login cannot do

It is just as useful to know the limits of this setup, because they explain why some feed features you may have seen elsewhere are not on offer.

1. No ads or tagging. Meta states that this setup “cannot access ads or tagging,” and its comparison lists product tagging and Partnership Ads as not supported. So a feed built on Instagram Login does not offer shoppable product tags from Instagram.
2. No hashtag search. Hashtag search is supported only with the Facebook Login setup. A feed based on Instagram Login shows your own posts, not a hashtag.
3. Only accounts that signed in. An app reads the professional account that approved it. It cannot pull another person’s or brand’s posts just because they are public.
4. Only professional accounts. Personal and private accounts cannot be connected.

For most small business and creator websites, none of this is a problem: the goal is to show your own recent posts on your own site, and that is exactly what the basic permission covers.

Standard Access, Advanced Access and App Review

You may see these terms if you look into Meta’s documentation. They concern the app developer, not you, but they explain something useful.

Meta’s overview describes two access levels. Standard Access “is the default access level for all apps and limits the data your app can get,” and suits an app that only serves Instagram professional accounts its developer owns or manages. Advanced Access is needed when an app serves accounts the developer does not own or manage, which is the situation for any feed service used by the public. Meta says this access level “requires App Review and Business Verification.”

In other words, a public service that lets anyone connect an account must go through Meta’s review of the permissions it asks for. That is one more reason a feed tool should ask for as little as it needs.

How to check what any feed tool is asking for

Whatever tool you use, the authorization window is your chance to see what you are agreeing to. A quick checklist:

1. Make sure you are on Instagram’s own page. The sign-in should happen on instagram.com, not inside a form on the tool’s website. A tool that asks for your Instagram password directly is a warning sign.
2. Read the list of permissions. A feed that only displays your posts needs only to read your profile and media.
3. Question anything extra. If a simple feed widget asks to publish, manage comments or manage messages, ask the provider why. There may be a reason, such as a scheduling feature, but it should be one you actually use.
4. Check which account you are signing in to. If you manage several Instagram accounts, confirm the username before approving. Social Feed asks Instagram to show the sign-in step each time, so you can choose the account you mean.
5. Note where to disconnect. You should be able to remove the connection both in the tool and in Instagram’s own settings.

If you plan to build your own integration

Some site owners with a developer on hand consider skipping a feed tool and calling the API directly. It is possible, and Meta documents the basics. A few points from Meta’s getting-started guide to be aware of:

1. You need a Meta app of the Business type. Meta says that if your current app “is not a Business type app you will need to create a new app.”
2. Requests for this setup go to graph.instagram.com, and posts are fetched from the account’s /media endpoint.
3. You are responsible for refreshing the long-lived token every 60 days, handling expired or cancelled tokens, and storing the token securely on a server, never in your page’s code where visitors could copy it.
4. If the app will serve accounts you do not own or manage, plan for App Review and Business Verification.

If you only need your own feed on your own site, a ready-made widget saves that work. If you are weighing the options, our Instagram feed widget comparison covers several tools side by side.

Removing access later

You stay in control after connecting. There are two places to end a connection:

1. In Social Feed. Use Disconnect on the account in the dashboard. This removes the connection and also deletes that account’s widgets and their settings, so the feeds stop showing on your site.
2. In Instagram. Instagram’s Help Center explains how to review and remove the apps and websites connected to your account from Instagram’s settings, under Apps and websites. Removing an app there cancels the permission, and Meta only allows a token to be refreshed while the basic permission is granted, so the connection cannot be renewed.

If you only want to hide a feed for a while, there is no need to disconnect. Switch the widget to Unpublished in the dashboard instead; see how to hide your feed temporarily.

Common problems when connecting

1. The connection fails, or your account is not accepted. The most common cause is a personal account. Switch to Business or Creator in Instagram, then connect again.
2. You connected the wrong account. Your phone or browser may be signed in to another Instagram account. Disconnect it in the dashboard, then connect again and choose the right account on the Instagram sign-in page.
3. The feed stopped after you changed your Instagram password. A password change can end existing connections. Reconnect; the steps are in our access token article.
4. You changed your username. The connection is tied to the account, not the name. See what happens when you change your Instagram username.
5. The feed shows nothing on your site even though the connection is fine. That is usually a website issue rather than an API issue. Work through Instagram feed not showing on your website?

Frequently asked questions

Do I need a Facebook account or Facebook Page?
Not for this API. Meta says the Instagram Login setup does not require a Facebook Page. You sign in with your Instagram credentials. Logging in with Facebook is offered as an option on Instagram’s sign-in page, but you do not have to use it.

Can the feed tool post to my Instagram?
Only if you grant a publishing permission. Social Feed by grip space requests only instagram_business_basic, which reads your profile and posts, so it cannot post, comment or message.

Does Social Feed know my Instagram password?
No. You sign in on Instagram’s own page, and the app receives a code and then an access token, not your password.

Is my data shared with my website visitors?
Visitors see what anyone can see on your public Instagram profile: your posts, captions and, if you turn it on, like counts and the account header. Nothing else from your account is read or shown.

Why can’t I show a hashtag or another brand’s posts?
With Instagram Login, an app reads the account that signed in. Meta’s comparison lists hashtag search as not supported in this setup. Social Feed shows the account you connect, one account per widget.

Can I connect more than one Instagram account?
Yes, each signed in separately, and each widget shows one account. To place several feeds on one site, see multiple Instagram feeds on one website.

How often does the feed update?
New posts appear once a day on the Free plan and right away on paid plans. See pricing and why a feed might not be updating.

Want to try it with your own account? Create a free account, connect your Instagram professional account, and follow the guide for your platform: WordPress, Shopify, Wix, Squarespace, Webflow or plain HTML.

Sources

1. Meta for Developers, “Instagram API with Instagram Login”: https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/
2. Meta for Developers, “Overview of the Instagram API”: https://developers.facebook.com/docs/instagram-platform/overview/
3. Meta for Developers, “Business Login for Instagram”: https://developers.facebook.com/documentation/instagram-platform/instagram-api-with-instagram-login/business-login
4. Meta for Developers, “Get started” (Instagram API with Instagram Login): https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/get-started
5. Meta for Developers, Permissions Reference, “instagram_business_basic”: https://developers.facebook.com/docs/permissions/reference/instagram_business_basic
6. Meta for Developers, “Insights” (Instagram Platform): https://developers.facebook.com/docs/instagram-platform/insights/
7. Meta for Developers, “Refresh Access Token”: https://developers.facebook.com/docs/instagram-platform/reference/refresh_access_token/
8. Instagram Help Center, managing apps and websites connected to Instagram: https://help.instagram.com/1144624522593085