Instagram Basic Display API Is Deprecated: What Broke and How Migration Actually Works (2026)
On December 4, 2024 Meta deprecated the Instagram Basic Display API. Every request to it now returns an error. The official advice is to migrate to the Instagram API — but that is not a swap of endpoints. It changes which accounts your app is allowed to serve, which permissions you must request, and whether you now need App Review and Business Verification at all.
What actually died
Basic Display was the easy door. It read basic profile fields and media from ordinary consumer Instagram accounts, needed almost nothing, and powered a generation of portfolio widgets, feed embeds, link-in-bio tools and gallery plugins. Meta shut the door. Its own changelog is blunt: the API has been deprecated, and all requests to it return an error message.
What replaced it is not a lighter version of the same thing. The Instagram API serves Instagram professional accounts only — businesses and creators. If your product was built on consumer accounts, there is no like-for-like replacement. That is the part most migration checklists quietly skip.
What the replacement requires
A professional account, not a personal one
Your users must convert to an Instagram professional account — business or creator. Personal accounts are simply outside the API. See why personal accounts block API access.
A choice of login configuration
Instagram API with Instagram Login (graph.instagram.com, no Facebook Page needed) or Instagram API with Facebook Login (graph.facebook.com, linked Page required). The two are not interchangeable — see our configuration comparison.
Real permissions, not a token grab
Instagram Login uses instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_messages. The older short-form scope values were deprecated on January 27, 2025.
App Review and Business Verification
Standard Access only serves accounts that have a role on your app. To serve accounts you do not own or manage — which is the entire point of a public product — you need Advanced Access, and that means App Review plus Business Verification.
Where migrations quietly fail
- Treating it as a base-URL swap. Different host, different app ID, different token type, different permission names, different consent flow. The endpoint change is the smallest part of the work.
- Ignoring the account-type wall. Every user still on a personal account has to convert before your app can read anything. For a consumer-facing widget, that is not a migration — it is a change of market.
- Assuming no review is needed. Basic Display let apps serve strangers with minimal friction. The Instagram API does not. Advanced Access is gated behind App Review, and Business Verification sits behind that.
- Still sending the old scope strings. business_basic, business_content_publish, business_manage_comments and business_manage_messages were deprecated on January 27, 2025. Apps that never updated cannot call the Instagram endpoints at all.
- Missing the second wave of deprecations. The Instagram v1.0 endpoints were deprecated too, with a long list of affected calls. A codebase that survived one deprecation is often quietly broken by the next.
- Submitting a review that reviewers cannot complete. A migrated app with a half-built login flow gets rejected — not for policy, but because the reviewer could not test it. Our rejection-reasons guide covers how often this is the real cause.
How a migration is actually sequenced
Audit what your app really reads
List every field and endpoint currently used, then find its Instagram API equivalent — or accept that it has none. This is where scope creep is caught early instead of during review.
Decide the login configuration
Instagram Login or Facebook Login. Ads, hashtag search, product tagging and Partnership Ads force Facebook Login. Everything else usually favours Instagram Login.
Rebuild the auth and token layer
New app ID, new consent flow, and a token lifecycle to honour: authorization code valid one hour, short-lived token one hour, long-lived token 60 days and refreshable before expiry.
Prepare the App Review submission
Advanced Access, Business Verification, a use case a reviewer understands, and a screencast that demonstrates each requested permission being used in the product.
The specifics inside each step — the exact permission list your endpoints require, the reviewer-facing test account, the screencast that survives a first-pass review — are the difference between a two-week migration and a two-month one. They are deliberately not laid out here.
What this means for your product
- Your addressable users may shrink. Consumer accounts are gone. Anyone who will not convert to a professional account cannot be served.
- Your compliance surface grows. Business Verification means a real business entity, real documents, and a review process of its own.
- Your review risk is now permanent. Permissions can be re-reviewed, apps can be restricted, and every new feature can pull in a new permission and a new submission.
- Rate limits are usage-based. Calls within 24 hours are calculated as 4800 multiplied by the number of impressions on the app user account — so low-activity client accounts get small call budgets.
Migrating off Basic Display and getting Advanced Access approved on the first submission is exactly the kind of work our Instagram App Review service handles. If you already know which permissions you need, start with Instagram API Advanced Access approval.
Frequently asked questions
Is the Instagram Basic Display API really gone?
Yes. Meta deprecated it on December 4, 2024 and states that all requests to it return an error message. There is no extension or grandfathering path documented.
Can I still read a personal Instagram account?
Not through the Instagram API. It serves Instagram professional accounts — business and creator — only. This is the single biggest breaking change for apps built on Basic Display.
Do I need App Review after migrating?
If your app serves only Instagram professional accounts you own or manage, Standard Access is enough. If it serves other people accounts, you need Advanced Access — which requires App Review and Business Verification.
Which login should a migrating app choose?
Instagram Login if you only need basic data, publishing, comments or messaging — it needs no Facebook Page. Facebook Login if you need ads, hashtag search, product tagging or Partnership Ads, which the Instagram Login setup cannot access.
Facts here are based on Meta official Instagram Platform documentation and Changelog (Basic Display deprecation dated December 4, 2024; new Instagram API launch dated July 23, 2024; scope deprecation dated January 27, 2025), reviewed July 2026. This is technical implementation guidance, not legal advice, and is not affiliated with or endorsed by Meta Platforms, Inc. Meta makes all App Review, verification and enforcement decisions independently; no specific outcome or timeline can be guaranteed. Stuck on a Basic Display migration? Reach out through the contact options in the footer.