How to Auto-Post to Instagram With the API (2026): The Honest, Complete Guide

Short answer: yes, you can post to Instagram from your own code. The Instagram Graph API supports publishing photos, videos, Reels and carousels to a Business or Creator account.

Longer answer: getting there for real users, not just yourself, is one of the most painful developer onboarding flows on the internet. I know because I just went through the entire thing, including the part where Meta silently restricts your account and blocks the exact step you need. This guide is the honest version. Read it before you spend a weekend on it.

What you actually need before you write a single line of code

• A Meta developer account at developers.facebook.com.
• A Meta app (the app that owns your API access).
• An Instagram account that is Business or Creator. Personal accounts cannot publish via the API, full stop.
• For most flows, a Facebook Page linked to that Instagram account.
• A public privacy policy, terms of service, and a working data-deletion URL that all return HTTP 200.
• A square app icon, an app category, and a contact email.
• Patience measured in weeks.

The setup, step by step

1. Create the Meta app and add Instagram

In the App Dashboard, create an app, then add the Instagram product using "Instagram API with Instagram Login" (the older Basic Display API is deprecated and cannot publish). You will get an Instagram App ID and secret, which are different from your Meta app ID.

2. Wire up OAuth

You authorize against https://www.instagram.com/oauth/authorize, exchange the code at https://api.instagram.com/oauth/access_token, then call the Graph API at https://graph.instagram.com. The scopes you request for publishing are:

instagram_business_basic
instagram_business_content_publish

Ask for only what you can demonstrate. Requesting comment or messaging scopes you cannot show in a screencast is a fast way to get rejected.

3. Publish, which is two calls, not one

Instagram publishing is a two-step dance. First you create a media container, then you publish it:

POST /{ig-user-id}/media          # create container with image/video URL + caption
POST /{ig-user-id}/media_publish  # publish the returned creation-id

There is a publishing limit of roughly 100 posts per 24 hours per account, and your media has to be hosted at a public URL that Instagram can fetch.

4. Keep the token alive

Long-lived tokens last about 60 days. If you do not refresh them on a schedule, your integration silently dies and your posts stop going out. You now own a token-refresh cron job forever.

See how TimeToPost can help you implement these strategies.

The parts nobody warns you about

This is where the weekend project becomes a month-long project.

App Review. To let anyone other than you and a handful of testers connect, your app must pass Meta App Review. You submit written justifications for each permission plus a screencast of the real flow. Instagram review runs anywhere from a few days to about a month.

Business Verification is mandatory. Since February 2023, Advanced Access to publishing permissions requires your app to be connected to a verified business. No verified business, no public access. Verification wants a business portfolio and documents.

The advertising-restriction trap. Here is the one that will blindside you. Creating a new business portfolio on a fresh account can trigger an automated "your advertising access is restricted" flag. That same flag blocks you from creating a business portfolio at all, which blocks verification, which blocks Advanced Access. You end up in a loop where the thing you need to do is the thing you are banned from doing, and the only exit is an appeal that can take a week or may never open.

Standard vs Advanced Access. In Live mode with Standard Access, the API only works for people who have a role on your app. To reach the general public you need Advanced Access, which is gated behind everything above.

Being "Live" is not the finish line. Live plus App Review plus Business Verification plus Advanced Access is the finish line. Miss one and no real user can connect.

The realistic timeline and effort

| Step | Time | Can it block you? | |---|---|---| | Meta app + OAuth wiring | 1 to 2 days of dev | Rarely | | Business Verification | Days, sometimes weeks | Yes, hard | | App Review (Instagram) | Days to ~1 month | Yes | | Advertising-restriction appeal (if hit) | 48 hours to never | Yes, brutally | | Token refresh + rate-limit handling | Ongoing forever | Silent failures |

The honest math

If your goal is to actually publish to Instagram on a schedule, ask what your time is worth. The DIY route is roughly a month of calendar time, real ongoing maintenance, and a nonzero chance of an account restriction that stalls you indefinitely. And that is for one platform.

TimeToPost already did all of this. We hold the verified app, the approved permissions, and the token plumbing. You connect your Instagram Business account in about two clicks and schedule your first post the same minute. No developer account, no App Review, no verification paperwork, no advertising-ban roulette.

FAQ

Can I post to a personal Instagram account via the API? No. Only Business and Creator accounts can publish. This is a Meta rule, not a tool limitation.

Do I really need Business Verification just to post my own content for other users? Yes, for public "any user" access. Advanced Access requires a connected verified business.

Is there a free way to skip App Review? Only for yourself and accounts you add as testers. The moment you want real users, you need the full review.

Why did my account get restricted from advertising when I do not even run ads? Automated flags fire on new business portfolios and low-history accounts. The restriction is scoped to ads and portfolio creation, but portfolio creation is exactly what verification needs, so it blocks you anyway.

If you would rather skip the entire gauntlet, that is precisely why TimeToPost exists.