If your Instagram feed silently stopped updating sometime after late 2024, you didn't break anything — Instagram did. The API that powered the overwhelming majority of "show my Instagram on my website" integrations was switched off, and its replacements work very differently.
This post is the technical deep-dive: what actually changed at the API layer, why personal accounts no longer work, and exactly how the Divi Instagram Feed plugin talks to Meta's current APIs under the hood.
1. The big break: Basic Display API end-of-life
The Instagram Basic Display API reached end-of-life on December 4, 2024. It is not deprecated-but-working — it is off. Any integration still calling graph.instagram.com Basic Display endpoints with personal-account tokens now fails outright.
Basic Display was the easy path: a personal Instagram account, a simple OAuth consent, a long-lived token, and /me/media. That simplicity is gone, and there is no successor that supports personal accounts. This is the single most important fact for anyone embedding Instagram in 2026:
Personal Instagram accounts can no longer be accessed via any official API. You need a Professional account — Business or Creator.
2. The 2026 landscape: two APIs, not one
Meta now exposes Instagram through two distinct products. Choosing the right one is the whole game.
A. Instagram API with Instagram Login
This is the direct functional successor to Basic Display, built for "display my own content" use cases. Key properties:
- Host:
graph.instagram.com(largely unversioned for these endpoints). - Account types: Instagram Business or Creator. Crucially, Creator accounts do not require a linked Facebook Page — this is the lightweight path.
- Login: "Business Login for Instagram" — the user authenticates with Instagram directly, no Facebook account in the loop.
- Core scope for feeds:
instagram_business_basic(read profile + media). You do not need messaging, publishing, or insights scopes for a display widget — and requesting them will slow down App Review.
B. Instagram Graph API
The full-featured API for Business/Creator accounts that are connected to a Facebook Page.
- Host:
graph.facebook.com, versioned (e.g./v25.0/). - Login: Facebook Login; you traverse
me/accounts→ Page →instagram_business_account. - Scopes:
instagram_basic,pages_show_list,pages_read_engagement. - Use it when: the account is a Business account already managed through a Facebook Page.
How Divi Instagram Feed maps to this
The plugin supports both, selected by an account_type flag, in includes/ig/api.php:
private const INSTAGRAM_API_URL = 'https://graph.instagram.com/';
private const FACEBOOK_API_URL = 'https://graph.facebook.com/v23.0/';
private const DEFAULT_MEDIA_FIELDS =
'id,caption,media_type,media_url,permalink,thumbnail_url,timestamp,'
. 'username,comments_count,like_count,children{media_url,media_type,thumbnail_url}';
- Creator / "Instagram Login" path →
graph.instagram.com/mefor the profile andgraph.instagram.com/me/mediafor posts. - Business / Graph API path →
graph.facebook.com/v{ver}/{ig-user-id}/media, after resolving the Instagram Business account from the connected Page.
Both request the same media field set, so the rendered output is identical regardless of which API served it.
3. Account types: the rule that trips everyone up
| Account type | Supported in 2026? | Via which API |
|---|---|---|
| Personal | ❌ No | None (Basic Display is dead) |
| Creator | ✅ Yes | Instagram API with Instagram Login |
| Business | ✅ Yes | Instagram API with Instagram Login or Instagram Graph API |
The practical consequence for any plugin: if a user tries to connect a personal account, Instagram will simply refuse to issue a usable token. There is no code workaround — the only fix is for the user to convert their account to Professional (Settings → Account type and tools → Switch to Professional account → Creator). Conversion is free, reversible, and does not change the public appearance of the profile.
This is why Divi Instagram Feed now shows a persistent, page-scoped notice on its Accounts dashboard explaining the Professional-account requirement before a user attempts to connect — turning a confusing failed-token error into an actionable instruction.
4. Tokens: long-lived, but not forever
Both APIs use long-lived access tokens valid for ~60 days. They do not auto-renew — you must refresh them while they're still valid.
For the Instagram-Login path the refresh endpoint is:
GET https://graph.instagram.com/refresh_access_token
?grant_type=ig_refresh_token
&access_token={long-lived-token}
A refreshed token must be requested before expiry (best practice: every 50–55 days; a token that has already expired cannot be refreshed — the user has to reconnect).
Divi Instagram Feed automates this with WordPress cron. It registers a custom ~30-day schedule and a refresh handler:
add_action('divi_instagram_feed_tokens_refresh', [$this, 'refresh_access_tokens']);
// ...
wp_schedule_event(time(), 'monthly', 'divi_instagram_feed_tokens_refresh');
On each run it iterates connected accounts and calls refresh_access_token for the Instagram-Login accounts, storing the new token back in the divi_instagram_feed_accounts option. Because the refresh interval (~30 days) is well inside the 60-day token life, tokens stay valid without any user intervention — as long as the site's WP-Cron actually fires (worth noting for low-traffic sites that may need a real system cron).
5. Graph API versioning (don't pin and forget)
The Instagram Graph API path runs on versioned Facebook endpoints. Meta ships a new version roughly quarterly and supports each for about two years:
| Version | Released |
|---|---|
| v25.0 | Feb 18, 2026 |
| v24.0 | Oct 8, 2025 |
| v23.0 | May 29, 2025 |
| v22.0 | Jan 21, 2025 |
The current plugin build pins v23.0. That still works today, but it's on a deprecation clock (≈ mid-2027). A healthy maintenance practice — for any Graph API integration — is to track Meta's changelog and bump the version constant ahead of the two-year window rather than waiting for calls to start 4xx-ing. (The graph.instagram.com Instagram-Login endpoints are effectively unversioned, so only the Business/Graph path needs this attention.)
6. Fetching media: the request that builds the feed
Once an account is connected, rendering a feed is a single fielded request:
# Instagram Login (Creator/Business, no Page)
GET https://graph.instagram.com/me/media
?fields=id,caption,media_type,media_url,permalink,thumbnail_url,
timestamp,username,comments_count,like_count,
children{media_url,media_type,thumbnail_url}
&limit={n}&access_token={token}
# Instagram Graph API (Business via Page)
GET https://graph.facebook.com/v25.0/{ig-user-id}/media?fields=...&access_token={token}
Notes that matter in production:
media_typeis one ofIMAGE,VIDEO,CAROUSEL_ALBUM. For video, renderthumbnail_url(notmedia_url); for carousels, descend intochildren.like_count/comments_countare available on owned-account media and power the hover-overlay stats — but treat them as optional and degrade gracefully if absent.- Rate limits are real: roughly 200 calls/hour per Instagram account. A feed widget must cache aggressively rather than calling the API on every page view.
Divi Instagram Feed caches API responses in WordPress transients (prefixed dif_insta_feed_*) with a configurable TTL, and ships a Cache Manager admin page to inspect/clear them. This keeps a high-traffic page from ever approaching the hourly limit, since visitors are served the cached payload and the API is only hit when the cache expires.
7. The plugin-distribution wrinkle: App Review & Advanced Access
This part is invisible to end users but decisive for any plugin developer.
A WordPress plugin is one Meta app used by thousands of unrelated site owners, each connecting their own Instagram account. Meta's permission model has two tiers:
- Standard Access — only works for users with a role on the app (you and your testers).
- Advanced Access — works for the general public.
Without Advanced Access on instagram_business_basic (and the Business-path scopes), every customer connection fails. Advanced Access is granted only through App Review, which requires:
- Business verification, a Live-mode app, privacy policy, and a data-deletion path.
- A use-case description scoped to exactly what the app does (read profile + media to display a feed).
- A screencast showing the full flow — OAuth consent screen included — and the data actually rendering on a front-end page.
- Reviewer-reproducible test instructions, demoed with a Creator or Business account (never a personal one).
Least-privilege is not just good hygiene here; requesting scopes the demo doesn't visibly exercise is a common rejection reason.
8. Migration checklist
If you're moving an old Basic Display integration (or just reconnecting a broken feed):
- Convert the Instagram account to Professional (Creator is enough; no Facebook Page needed for the Instagram-Login path).
- Reconnect through the plugin — old personal-account tokens are dead and cannot be refreshed.
- Confirm WP-Cron is firing so token refresh actually runs every ~30 days; on low-traffic sites, wire a real system cron to
wp-cron.php. - Set a sane cache TTL — long enough to stay well under 200 calls/hour, short enough that new posts appear reasonably quickly.
- (Developers) Track Meta's changelog and bump the Graph API version constant before the ~2-year deprecation window closes.
Summary
The 2024 Basic Display shutdown ended the era of frictionless personal-account embeds. In 2026 the rules are simple, even if the migration isn't: Professional account, correct API for the account type, long-lived tokens refreshed on a schedule, aggressive caching, and — for plugin authors — Advanced Access via App Review. Divi Instagram Feed implements all five so the site owner's only required action is the one no code can do for them: switch to a Professional account and click Connect.
