Instagram

Instagram (Instagram API with Facebook Login)

This connector calls the Graph API at https://graph.facebook.com/v25.0 for one Instagram professional account (business or creator) that is linked to a Facebook Page. Personal Instagram accounts have no API access.

Authentication. Meta's Facebook Login issues no refresh tokens: a token from the login dialog or the Graph API Explorer lasts one to two hours, a long-lived user token about 60 days. The connector takes a ready token in INSTAGRAM_ACCESS_TOKEN, in one of two ways:

1. System User token (recommended, never expires): Meta Business settings, Users, System users, Generate token, expiry Never. Grant it instagram_basic, instagram_manage_insights, instagram_manage_comments, pages_show_list, pages_read_engagement and business_management; add instagram_content_publish only if you want to publish. Assign the Facebook Page and the Instagram account to the system user as assets.
2. User token, renewed automatically: paste a user token from the Graph API Explorer (https://developers.facebook.com/tools/explorer/) with the same permissions, and set META_APP_ID and META_APP_SECRET (the app's App settings, Basic). AnythingMCP exchanges the token for a long-lived one (about 60 days) on its first call and renews it on the first call once fewer than 10 days remain. Without the app ID and secret the token is used as pasted: a short-lived one stops within hours, and the connector page warns before a token expires.

A token stops working for good when the user logs out of Facebook, changes the password or removes the app (error 190 with subcode 467, 460 or 458). The connector then answers at once with what to do instead of retrying; paste a new token to continue.

Which tool first. instagram_list_linked_accounts lists the Facebook Pages the token can see with the Instagram account linked to each; the instagram_business_account.id there (a number starting with 1784) is the value for INSTAGRAM_ACCOUNT_ID. Then instagram_get_account checks the setup and returns follower and media counts. Tools that act on the account take its id from the connector, so you never pass it.

Ids. Media ids come from instagram_list_media, instagram_list_stories or instagram_list_tagged_media; comment ids from instagram_list_comments; hashtag ids from instagram_search_hashtag. Ids are strings of digits; pass them unchanged.

Fields. The Graph API returns only the fields you ask for. Every read tool has a fields parameter with a sensible default; add fields with a comma, nested fields with braces, e.g. children{media_url}.

Pagination. List answers carry paging.cursors.after and paging.next. Call the tool again with after set to that cursor; when paging.next is missing you have the last page. since and until take Unix timestamps.

Insights. Account insights need metric and period=day; most metrics also need metric_type=total_value. Use views instead of impressions (removed in v22.0). Demographic metrics (follower_demographics, engaged_audience_demographics) need period=lifetime, metric_type=total_value, a timeframe and a breakdown (age, city, country, gender). Data can lag up to 48 hours, accounts below 100 followers return no demographics, and a metric that does not apply returns an error rather than zero. Media insights: reach,likes,comments,saved,shares,total_interactions,views for posts and reels, reach,replies,navigation,views for stories (stories expire after 24 hours).

Hashtags. instagram_search_hashtag turns a name into an id; an account can query at most 30 distinct hashtags in a rolling 7 days. Top and recent media return public posts only, without usernames. Hashtag search needs the Instagram Public Content Access feature on the app.

Publishing (switched off at install): create a container with instagram_create_media_container, check instagram_get_container_status until status_code is FINISHED (videos take a while), then instagram_publish_media. Media must be at a public HTTPS URL. API publishing is limited to 50 posts per 24 hours; instagram_get_publishing_limit shows the usage.

Rate limits. Business Use Case limits: about 4800 calls per 24 hours times the account's impressions. A 400 with error code 4, 17, 32 or 613 means throttled: wait and retry. Error 190 means the token expired or was revoked; error 10 or 200 means a permission is missing.