Every Instagram API permission scope in 2026: what each grants, which endpoints it opens, and why the 2 login paths name the same access differently.
- Instagram API permissions come in 2 scope families: Facebook Login uses instagram_basic, Instagram Login uses instagram_business_basic, and the wrong string fails.
- Only the Facebook Login path reaches instagram_manage_insights, which returns audience demographics for the authorising account alone.
- Short scope values such as business_basic were deprecated on 27 January 2025 and no longer work.
- Standard Access works only for people with a role on your app; customers need Advanced Access, granted via App Review in 2 to 4 weeks.
- No scope returns data on an account that never authorised your app, because Meta releases it to the holder alone.
Instagram permissions confuse people for a specific reason: there are 2 valid names for most capabilities, and which one you use depends on how the account authenticates rather than on what you are trying to do.
If your app uses Facebook Login for Business, you request instagram_basic. If it uses Business Login for Instagram, you request instagram_business_basic. Same access, different string, different host, and an error message that mentions neither.
What follows is every current scope, what each one actually unlocks, which endpoints it opens, and the permission tier that decides whether any of it works for anyone other than you. Everything here is from Meta's Instagram Platform documentation as of July 2026.
Why are there 2 sets of scope names?
Because Meta runs 2 authentication paths into the same platform, and they were built at different times.
Facebook Login for Business is the older route. The Instagram professional account must be linked to a Facebook Page, and your app asks for permissions on the Page as well as the Instagram account. That is why pages_show_list and pages_read_engagement appear alongside the Instagram scopes.
Business Login for Instagram is the newer route. The user authenticates with Instagram directly, no Facebook account in the flow, and no linked Page is required. Its scopes carry a _business_ segment to keep the scope values consistent with the permission names.
1 detail to check in an older codebase. The short scope values business_basic, business_content_publish, business_manage_comments and business_manage_messages were deprecated on 27 January 2025 and replaced by the instagram_business_ versions. Apps still sending the old strings cannot call the Instagram endpoints.
What does each Facebook Login scope unlock?
This is the fuller of the 2 sets. It is also the only path that reaches insights and ads-adjacent surfaces.
| Scope | What it unlocks | Fields and endpoints it opens |
|---|---|---|
instagram_basic | Read access to the account and its media | Profile: id, username, name, biography, profile picture URL, website, followers_count, follows_count, media_count. Media: id, caption, media_type, media_url, permalink, timestamp, like_count, comments_count |
instagram_content_publish | Publishing media to the account | The container and publish endpoints: create a media container, poll its status, then publish it. Covers images, video, Reels and carousels |
instagram_manage_comments | Reading and acting on comments | Comment lists on media, replies, hiding and deleting comments, and mention data |
instagram_manage_insights | Analytics for the authorised account | Account insights such as reach, impressions, profile views and follower count. Media-level insights. Audience demographics by age, gender and location |
instagram_manage_messages | Direct message access | Reading and sending messages in the Instagram inbox for the authorised professional account |
pages_show_list | Listing the Pages the user manages | The /me/accounts edge, which is how you find the linked Instagram account ID |
pages_read_engagement | Reading data on the linked Page | Page-level access required alongside several Instagram endpoints |
The row that matters most for creator products is instagram_manage_insights. It is the only scope that returns audience demographics, and it returns them for the account that authorised your app and nobody else. There is no permission that widens that.
What does each Instagram Login scope unlock?
A shorter list, because this path is deliberately narrower. It is also the lightweight option, since Creator accounts on this path do not need a linked Facebook Page.
| Scope | What it unlocks | Notes |
|---|---|---|
instagram_business_basic | Profile and media read access | The core scope for a feed, an embed or a display widget. Most display products need nothing else |
instagram_business_content_publish | Getting and publishing media | Same container-then-publish flow as the Facebook Login path |
instagram_business_manage_comments | Comment moderation | Manage and reply to comments on the account's media |
instagram_business_manage_messages | Messaging | Send and receive messages with people who contact the account |
2 limits on this path are worth knowing before you choose it. It cannot access ads or tagging at all. And Instagram Media Insights arrived for this path after launch, so if your build predates that, check the current documentation rather than an older tutorial.
If you want the field list rather than the scope list, our per-platform coverage page shows exactly what Instagram returns and what needs authorisation. See the coverage list
Which permissions are not scopes?
2 of the things you may need are classed as features rather than permissions, and they are requested separately in App Review.
| Feature | What it does |
|---|---|
| Human Agent | Lets a human agent reply to a user message using the human_agent tag within 7 days of that user's message. It exists for cases the standard messaging window does not cover, such as an issue raised over a weekend or one that takes longer than 24 hours to resolve |
| Instagram Public Content Access | Opens the Hashtag Search endpoints. The allowed uses are specific: discovering content tied to your hashtag campaigns, understanding public sentiment about your brand, identifying contest entrants, customer support and audience management. It requires App Review and business verification, and Meta notes you may need to sign additional contracts |
Hashtag Search is frequently mistaken for a creator discovery tool. It is not. You cannot request the username field on hashtag results, so you see the post and not the poster. We covered what those public surfaces do and do not return in social media public data.
What is the difference between Standard and Advanced Access?
It is the difference between an integration that works for you and one that works for your customers, and it catches teams at launch rather than during development.
- Standard Access works only for people who have a role on your app: you, your developers and your testers. Everything will function perfectly in development.
- Advanced Access is what allows the general public to connect. Without it on the scopes you use, every real customer connection fails.
Advanced Access is granted only through App Review. What Meta expects with a submission:
- Business verification completed.
- The app in Live mode.
- A privacy policy URL that addresses your handling of Instagram data specifically, not a generic template.
- A documented data deletion path.
- A use case description scoped to exactly what your app does. "Read profile and media to display a feed" is the right level of specificity.
- A screencast showing the whole flow, including the OAuth consent screen, and the data actually rendering in your product.
- Test instructions a reviewer can reproduce, demonstrated with a Business or Creator account rather than a personal one.
1 exception is worth knowing. If reviewers cannot test your app because it sits behind a private intranet, has no user interface, or has not implemented Facebook Login for Business, Meta will consider approval for instagram_basic and instagram_manage_comments only. Everything else needs a testable flow.
Which scopes does your product actually need?
Map the product to the scope set before you write the authorisation URL. Requesting scopes you do not use is one of the most common rejection causes, and it is entirely avoidable.
| What you are building | Facebook Login path | Instagram Login path |
|---|---|---|
| Feed embed or display widget | instagram_basic, pages_show_list | instagram_business_basic |
| Scheduling and publishing tool | instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement | instagram_business_basic, instagram_business_content_publish |
| Comment moderation or community tool | instagram_basic, instagram_manage_comments | instagram_business_basic, instagram_business_manage_comments |
| Creator analytics dashboard | instagram_basic, instagram_manage_insights, pages_show_list, pages_read_engagement | Check current insights support on this path |
| Support inbox or DM automation | instagram_basic, instagram_manage_messages, plus Human Agent | instagram_business_basic, instagram_business_manage_messages, plus Human Agent |
| Hashtag campaign tracking | instagram_basic plus Instagram Public Content Access | Not available on this path |
A note on review time. Standard permissions commonly clear Meta app review in roughly 2 to 4 weeks. Messaging scopes are treated as more sensitive and take longer, and any request for revisions restarts the clock. Build that runway into a launch plan rather than treating review as a final formality.
What does no scope unlock?
4 things, and none of them are permissions problems. Approving more scopes will not produce any of them, which is worth establishing before a roadmap depends on it.
| What you cannot get | Why |
|---|---|
| Audience demographics for a creator who has not authorised your app | Meta releases audience breakdowns to the account holder only. instagram_manage_insights returns them for the authorising account and nobody else |
| Any data from a personal Instagram account | Both paths require a Professional account, meaning Business or Creator. The Basic Display API, which was the only personal-account route, was shut down on 4 December 2024 |
| Follower and following lists | Not exposed through the API. You get counts, not the underlying list |
| Historical Stories metrics | Stories expire after 24 hours and are not archived by the API. Capturing them means polling while they are live |
The first row is the one that reshapes products. If a brand wants to see the audience breakdown of a creator they are merely considering, no scope reaches it, because it is a platform policy decision rather than a technical limit. We set out that boundary in authenticated versus public social data.
What are the most common scope mistakes?
- Using the wrong scope family. Copying
instagram_basicinto an Instagram Login flow, orinstagram_business_basicinto a Facebook Login flow. The error will not tell you which one you got wrong. - Still sending the deprecated short values.
business_basicand its siblings stopped working on 27 January 2025. - Requesting insights or messaging for a display widget. It slows review and gives a reviewer a reason to ask questions.
- Testing only with team accounts. Standard Access makes a broken integration look finished right up until a customer tries it.
- Forgetting the Page scopes on the Facebook Login path. Without
pages_show_listyou cannot find the linked Instagram account ID in the first place. - Assuming a scope survives a token refresh. Tokens expire, and if a user revokes the app the scope goes with it. Handle revocation separately from expiry.
Where does Phyllo fit?
We handle this layer so your team does not. When a creator connects their Instagram account through your product, Phyllo's Instagram API manages the authorisation flow, the scope requests, the app review burden and the token lifecycle, and returns normalised fields through the same schema that serves 25+ other platforms.
That includes the fields behind instagram_manage_insights: real impressions and reach, audience demographics by age and location, and performance on formats a public source cannot see. The field list per platform is public at getphyllo.com/coverage and the API reference needs no sales call. If you want the wider picture of the platform, including rate limits and the publishing flow, it is in our complete Instagram API guide, and the approval process is covered in Instagram API access.
Where we are not the right answer: if Instagram is your only platform and you have an engineer with capacity, request the scopes yourself. Meta charges nothing for the API and the documentation is good. The case for a layer starts at the second or third platform, because every one of them has its own scope names, its own review process and its own token behaviour.
The short version
Pick the login path first, because it decides every scope name you will write. Facebook Login for Business if you need insights, ads-adjacent surfaces or hashtag access. Business Login for Instagram if you need profile, media, comments, publishing or messaging and would rather skip the Facebook Page requirement.
Then request the smallest set that your product visibly uses, and plan for Advanced Access as a separate milestone rather than a formality. The scopes are the easy part. Getting them approved for real users is the part that takes the calendar time.
Want the fields without running the review process for every platform? We handle the scopes, the review and the token lifecycle across 25+ networks. Get a demo
What permissions does the Instagram API require?
It depends on the login path. Facebook Login for Business uses instagram_basic plus content, comments, insights and messages scopes and 2 Page scopes. Instagram Login uses the instagram_business_ set.
What is the difference between instagram_basic and instagram_business_basic?
Nothing in terms of access. They are the same capability named for the 2 login paths: instagram_basic for Facebook Login for Business, instagram_business_basic for Business Login for Instagram.
Which scope gives me Instagram audience demographics?
instagram_manage_insights on the Facebook Login path. It returns age, gender and location breakdowns for the account that authorised your app only. No scope returns them for an unconnected creator.
Do I need a Facebook Page to use the Instagram API?
On the Facebook Login for Business path, yes: the professional account must be linked to a Page. On the Business Login for Instagram path, no Page is required, which makes it the lighter route.
What is the difference between Standard and Advanced Access?
Standard Access works only for people with a role on your app, meaning you and your testers. Advanced Access lets the general public connect and is granted only through Meta App Review.
How long does Instagram app review take?
Commonly 2 to 4 weeks for standard permissions with a complete submission. Messaging scopes are treated as more sensitive and take longer, and a request for revisions restarts the clock.
Why was my Instagram permission request rejected?
Common causes: requesting scopes the product does not visibly use, a privacy policy that ignores Instagram data, a screencast missing the consent screen, and test instructions on a personal account.
